[3.13] Fix integer overflow for formats "s" and "p" in the struct module (GH-145750...

(cherry picked from commit 4d0dce0c8ddc4d0321bd590a1a33990edc2e1b08)

diff --git a/Lib/test/test_struct.py b/Lib/test/test_struct.py
index 0105027403ae1972356dad8aa585c8484f83c5da..0aa71d20db89e46acfb66aedbe558ddf693e93ec 100644 (file)
--- a/Lib/test/test_struct.py
+++ b/Lib/test/test_struct.py
@@ -550,6 +550,12 @@ class StructTest(unittest.TestCase):
         hugecount3 = '{}i{}q'.format(sys.maxsize // 4, sys.maxsize // 8)
         self.assertRaises(struct.error, struct.calcsize, hugecount3)
 
+        hugecount4 = '{}?s'.format(sys.maxsize)
+        self.assertRaises(struct.error, struct.calcsize, hugecount4)
+
+        hugecount5 = '{}?p'.format(sys.maxsize)
+        self.assertRaises(struct.error, struct.calcsize, hugecount5)
+
     def test_trailing_counter(self):
         store = array.array('b', b' '*100)
 

diff --git a/Misc/NEWS.d/next/Library/2026-03-10-14-13-12.gh-issue-145750.iQsTeX.rst b/Misc/NEWS.d/next/Library/2026-03-10-14-13-12.gh-issue-145750.iQsTeX.rst
new file mode 100644 (file)
index 0000000..a909bea
--- /dev/null
+++ b/Misc/NEWS.d/next/Library/2026-03-10-14-13-12.gh-issue-145750.iQsTeX.rst
@@ -0,0 +1,3 @@
+Avoid undefined behaviour from signed integer overflow when parsing format
+strings in the :mod:`struct` module. Found by OSS Fuzz in
+:oss-fuzz:`488466741`.

diff --git a/Modules/_struct.c b/Modules/_struct.c
index 93b913955538b678a4c05c3fc3c86eb818c5c36a..4c84950af344b8e1151b3c58f9f062bce148f2f4 100644 (file)
--- a/Modules/_struct.c
+++ b/Modules/_struct.c
@@ -1476,7 +1476,13 @@ prepare_s(PyStructObject *self, PyObject *format)
 
         switch (c) {
             case 's': /* fall through */
-            case 'p': len++; ncodes++; break;
+            case 'p':
+                if (len == PY_SSIZE_T_MAX) {
+                    goto overflow;
+                }
+                len++;
+                ncodes++;
+                break;
             case 'x': break;
             default:
                 if (num > PY_SSIZE_T_MAX - len) {