From: Guido van Rossum <guido@python.org>
Date: Fri, 11 Oct 2002 21:13:14 +0000 (+0000)
Subject: Backport listobject.c 2.137 and tupleobject.c 2.75:
X-Git-Tag: v2.2.2~22
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=3974ce3a313875b15fa6825a7acb4a22b8b27645;p=thirdparty%2FPython%2Fcpython.git

Backport listobject.c 2.137 and tupleobject.c 2.75:

Add checks for size overflow on list*n, list+list, tuple+tuple.
---

diff --git a/Objects/listobject.c b/Objects/listobject.c
index 355b2927c052..148e15c9c44e 100644
--- a/Objects/listobject.c
+++ b/Objects/listobject.c
@@ -399,6 +399,8 @@ list_concat(PyListObject *a, PyObject *bb)
 	}
 #define b ((PyListObject *)bb)
 	size = a->ob_size + b->ob_size;
+	if (size < 0)
+		return PyErr_NoMemory();
 	np = (PyListObject *) PyList_New(size);
 	if (np == NULL) {
 		return NULL;
@@ -427,6 +429,8 @@ list_repeat(PyListObject *a, int n)
 	if (n < 0)
 		n = 0;
 	size = a->ob_size * n;
+	if (size/a->ob_size != n)
+		return PyErr_NoMemory();
 	np = (PyListObject *) PyList_New(size);
 	if (np == NULL)
 		return NULL;
diff --git a/Objects/tupleobject.c b/Objects/tupleobject.c
index ab792def9323..394b40fa3f09 100644
--- a/Objects/tupleobject.c
+++ b/Objects/tupleobject.c
@@ -337,6 +337,8 @@ tupleconcat(register PyTupleObject *a, register PyObject *bb)
 	}
 #define b ((PyTupleObject *)bb)
 	size = a->ob_size + b->ob_size;
+	if (size < 0)
+		return PyErr_NoMemory();
 	np = (PyTupleObject *) PyTuple_New(size);
 	if (np == NULL) {
 		return NULL;