Commit a5c0e6d6 authored by Guido van Rossum's avatar Guido van Rossum

Add checks for size overflow on list*n, list+list, tuple+tuple.

Will backport.
parent 6e08c146
...@@ -391,6 +391,8 @@ list_concat(PyListObject *a, PyObject *bb) ...@@ -391,6 +391,8 @@ list_concat(PyListObject *a, PyObject *bb)
} }
#define b ((PyListObject *)bb) #define b ((PyListObject *)bb)
size = a->ob_size + b->ob_size; size = a->ob_size + b->ob_size;
if (size < 0)
return PyErr_NoMemory();
np = (PyListObject *) PyList_New(size); np = (PyListObject *) PyList_New(size);
if (np == NULL) { if (np == NULL) {
return NULL; return NULL;
...@@ -419,6 +421,8 @@ list_repeat(PyListObject *a, int n) ...@@ -419,6 +421,8 @@ list_repeat(PyListObject *a, int n)
if (n < 0) if (n < 0)
n = 0; n = 0;
size = a->ob_size * n; size = a->ob_size * n;
if (size/a->ob_size != n)
return PyErr_NoMemory();
np = (PyListObject *) PyList_New(size); np = (PyListObject *) PyList_New(size);
if (np == NULL) if (np == NULL)
return NULL; return NULL;
......
...@@ -330,6 +330,8 @@ tupleconcat(register PyTupleObject *a, register PyObject *bb) ...@@ -330,6 +330,8 @@ tupleconcat(register PyTupleObject *a, register PyObject *bb)
} }
#define b ((PyTupleObject *)bb) #define b ((PyTupleObject *)bb)
size = a->ob_size + b->ob_size; size = a->ob_size + b->ob_size;
if (size < 0)
return PyErr_NoMemory();
np = (PyTupleObject *) PyTuple_New(size); np = (PyTupleObject *) PyTuple_New(size);
if (np == NULL) { if (np == NULL) {
return NULL; return NULL;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment