Backport listobject.c 2.137 and tupleobject.c 2.75:

Add checks for size overflow on list*n, list+list, tuple+tuple.

diff --git a/Objects/listobject.c b/Objects/listobject.c
index 355b2927c0521c3f3ff9f562d050b11d2c04fe95..148e15c9c44e49ecf88aa35f3c5be76ff7b26aa5 100644 (file)
--- a/Objects/listobject.c
+++ b/Objects/listobject.c
@@ -399,6 +399,8 @@ list_concat(PyListObject *a, PyObject *bb)
        }
 #define b ((PyListObject *)bb)
        size = a->ob_size + b->ob_size;
+       if (size < 0)
+               return PyErr_NoMemory();
        np = (PyListObject *) PyList_New(size);
        if (np == NULL) {
                return NULL;
@@ -427,6 +429,8 @@ list_repeat(PyListObject *a, int n)
        if (n < 0)
                n = 0;
        size = a->ob_size * n;
+       if (size/a->ob_size != n)
+               return PyErr_NoMemory();
        np = (PyListObject *) PyList_New(size);
        if (np == NULL)
                return NULL;

diff --git a/Objects/tupleobject.c b/Objects/tupleobject.c
index ab792def9323a31a9d8388831dda6cf07ad422fe..394b40fa3f091b86f9ebfcc086946edb368acc7b 100644 (file)
--- a/Objects/tupleobject.c
+++ b/Objects/tupleobject.c
@@ -337,6 +337,8 @@ tupleconcat(register PyTupleObject *a, register PyObject *bb)
        }
 #define b ((PyTupleObject *)bb)
        size = a->ob_size + b->ob_size;
+       if (size < 0)
+               return PyErr_NoMemory();
        np = (PyTupleObject *) PyTuple_New(size);
        if (np == NULL) {
                return NULL;