changeset:   102447:8f84942a0e40
parent:      102445:128ad410c776
parent:      102446:ad3762227655
user:        Martin Panter <vadmium+py@gmail.com>
date:        Mon Jul 25 03:31:29 2016 +0000
files:       Misc/NEWS Objects/abstract.c
description:
Issue #27581: Merge overflow fix from 3.5


diff -r 128ad410c776 -r 8f84942a0e40 Misc/NEWS
--- a/Misc/NEWS	Sun Jul 24 23:01:28 2016 -0400
+++ b/Misc/NEWS	Mon Jul 25 03:31:29 2016 +0000
@@ -13,6 +13,9 @@
 - Issue #27507: Add integer overflow check in bytearray.extend().  Patch by
   Xiang Zhang.
 
+- Issue #27581: Don't rely on wrapping for overflow check in
+  PySequence_Tuple().  Patch by Xiang Zhang.
+
 - Issue #27419: Standard __import__() no longer look up "__import__" in globals
   or builtins for importing submodules or "from import".  Fixed a crash if
   raise a warning about unabling to resolve package from __spec__ or
diff -r 128ad410c776 -r 8f84942a0e40 Objects/abstract.c
--- a/Objects/abstract.c	Sun Jul 24 23:01:28 2016 -0400
+++ b/Objects/abstract.c	Mon Jul 25 03:31:29 2016 +0000
@@ -1747,21 +1747,22 @@
             break;
         }
         if (j >= n) {
-            Py_ssize_t oldn = n;
+            size_t newn = (size_t)n;
             /* The over-allocation strategy can grow a bit faster
                than for lists because unlike lists the
                over-allocation isn't permanent -- we reclaim
                the excess before the end of this routine.
                So, grow by ten and then add 25%.
             */
-            n += 10;
-            n += n >> 2;
-            if (n < oldn) {
+            newn += 10u;
+            newn += newn >> 2;
+            if (newn > PY_SSIZE_T_MAX) {
                 /* Check for overflow */
                 PyErr_NoMemory();
                 Py_DECREF(item);
                 goto Fail;
             }
+            n = (Py_ssize_t)newn;
             if (_PyTuple_Resize(&result, n) != 0) {
                 Py_DECREF(item);
                 goto Fail;