mirrors/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2025-11-02 19:12:55 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 8

Issue #27581: Don’t rely on overflow wrapping in PySequence_Tuple()

Browse source 
Patch by Xiang Zhang.
This commit is contained in:
Martin Panter 2016-07-25 02:30:05 +00:00
parent aa46bd461c
commit e8db861f47
2 changed files with 8 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

3
Misc/NEWS
View file

@ -25,6 +25,9 @@ Core and Builtins
- Issue #27507: Add integer overflow check in bytearray.extend(). Patch by - Issue #27507: Add integer overflow check in bytearray.extend(). Patch by
Xiang Zhang. Xiang Zhang.
- Issue #27581: Don't rely on wrapping for overflow check in
PySequence_Tuple(). Patch by Xiang Zhang.
- Issue #27443: __length_hint__() of bytearray iterators no longer return a - Issue #27443: __length_hint__() of bytearray iterators no longer return a
negative integer for a resized bytearray. negative integer for a resized bytearray.

9
Objects/abstract.c
View file

@ -1724,21 +1724,22 @@ PySequence_Tuple(PyObject *v)
break; break;
} }
if (j >= n) { if (j >= n) {
Py_ssize_t oldn = n; size_t newn = (size_t)n;
/* The over-allocation strategy can grow a bit faster /* The over-allocation strategy can grow a bit faster
than for lists because unlike lists the than for lists because unlike lists the
over-allocation isn't permanent -- we reclaim over-allocation isn't permanent -- we reclaim
the excess before the end of this routine. the excess before the end of this routine.
So, grow by ten and then add 25%. So, grow by ten and then add 25%.
*/ */
n += 10; newn += 10u;
n += n >> 2; newn += newn >> 2;
if (n < oldn) { if (newn > PY_SSIZE_T_MAX) {
/* Check for overflow */ /* Check for overflow */
PyErr_NoMemory(); PyErr_NoMemory();
Py_DECREF(item); Py_DECREF(item);
goto Fail; goto Fail;
} }
n = (Py_ssize_t)newn;
if (_PyTuple_Resize(&result, n) != 0) { if (_PyTuple_Resize(&result, n) != 0) {
Py_DECREF(item); Py_DECREF(item);
goto Fail; goto Fail;