From 3974ce3a313875b15fa6825a7acb4a22b8b27645 Mon Sep 17 00:00:00 2001 From: Guido van Rossum Date: Fri, 11 Oct 2002 21:13:14 +0000 Subject: [PATCH] Backport listobject.c 2.137 and tupleobject.c 2.75: Add checks for size overflow on list*n, list+list, tuple+tuple. --- Objects/listobject.c | 4 ++++ Objects/tupleobject.c | 2 ++ 2 files changed, 6 insertions(+) diff --git a/Objects/listobject.c b/Objects/listobject.c index 355b2927c052..148e15c9c44e 100644 --- a/Objects/listobject.c +++ b/Objects/listobject.c @@ -399,6 +399,8 @@ list_concat(PyListObject *a, PyObject *bb) } #define b ((PyListObject *)bb) size = a->ob_size + b->ob_size; + if (size < 0) + return PyErr_NoMemory(); np = (PyListObject *) PyList_New(size); if (np == NULL) { return NULL; @@ -427,6 +429,8 @@ list_repeat(PyListObject *a, int n) if (n < 0) n = 0; size = a->ob_size * n; + if (size/a->ob_size != n) + return PyErr_NoMemory(); np = (PyListObject *) PyList_New(size); if (np == NULL) return NULL; diff --git a/Objects/tupleobject.c b/Objects/tupleobject.c index ab792def9323..394b40fa3f09 100644 --- a/Objects/tupleobject.c +++ b/Objects/tupleobject.c @@ -337,6 +337,8 @@ tupleconcat(register PyTupleObject *a, register PyObject *bb) } #define b ((PyTupleObject *)bb) size = a->ob_size + b->ob_size; + if (size < 0) + return PyErr_NoMemory(); np = (PyTupleObject *) PyTuple_New(size); if (np == NULL) { return NULL; -- 2.47.3