diff options
author | Martin Panter <vadmium+py@gmail.com> | 2016-07-25 02:39:20 +0000 |
---|---|---|
committer | Martin Panter <vadmium+py@gmail.com> | 2016-07-25 02:39:20 +0000 |
commit | d668db1ce63db878bfbe6e05ccff9addd3003d64 (patch) | |
tree | 85e41c5f1acbe71e92b6869c12daa027e69bc5b8 /Objects/listobject.c | |
parent | 905a439b79986a67fbe27a629af0f9d159c38c18 (diff) | |
download | cpython-d668db1ce63db878bfbe6e05ccff9addd3003d64.tar.gz |
Issue #1621: Avoid signed overflow in list and tuple operations
Patch by Xiang Zhang.
Diffstat (limited to 'Objects/listobject.c')
-rw-r--r-- | Objects/listobject.c | 18 |
1 files changed, 10 insertions, 8 deletions
diff --git a/Objects/listobject.c b/Objects/listobject.c index ddc0fee41a..0b2c8c1dc2 100644 --- a/Objects/listobject.c +++ b/Objects/listobject.c @@ -488,9 +488,9 @@ list_concat(PyListObject *a, PyObject *bb) return NULL; } #define b ((PyListObject *)bb) - size = Py_SIZE(a) + Py_SIZE(b); - if (size < 0) + if (Py_SIZE(a) > PY_SSIZE_T_MAX - Py_SIZE(b)) return PyErr_NoMemory(); + size = Py_SIZE(a) + Py_SIZE(b); np = (PyListObject *) PyList_New(size); if (np == NULL) { return NULL; @@ -841,18 +841,20 @@ listextend(PyListObject *self, PyObject *b) return NULL; } m = Py_SIZE(self); - mn = m + n; - if (mn >= m) { + if (m > PY_SSIZE_T_MAX - n) { + /* m + n overflowed; on the chance that n lied, and there really + * is enough room, ignore it. If n was telling the truth, we'll + * eventually run out of memory during the loop. + */ + } + else { + mn = m + n; /* Make room. */ if (list_resize(self, mn) < 0) goto error; /* Make the list sane again. */ Py_SIZE(self) = m; } - /* Else m + n overflowed; on the chance that n lied, and there really - * is enough room, ignore it. If n was telling the truth, we'll - * eventually run out of memory during the loop. - */ /* Run iterator to exhaustion. */ for (;;) { |