Merged revisions 76629 via svnmerge from

svn+ssh://pythondev@svn.python.org/python/trunk

........
  r76629 | mark.dickinson | 2009-12-02 17:33:41 +0000 (Wed, 02 Dec 2009) | 3 lines

  Issue #7406:  Fix some occurrences of potential signed overflow in int
  arithmetic.
........

diff --git a/Objects/intobject.c b/Objects/intobject.c
index e73c92138c18a280fb39057f8cafbc5495c1e8c4..ebe029eac4a746935cc23b9c1a980e0d3941dda5 100644 (file)
--- a/Objects/intobject.c
+++ b/Objects/intobject.c
@@ -465,7 +465,8 @@ int_add(PyIntObject *v, PyIntObject *w)
        register long a, b, x;
        CONVERT_TO_LONG(v, a);
        CONVERT_TO_LONG(w, b);
-       x = a + b;
+       /* casts in the line below avoid undefined behaviour on overflow */
+       x = (long)((unsigned long)a + b);
        if ((x^a) >= 0 || (x^b) >= 0)
                return PyInt_FromLong(x);
        return PyLong_Type.tp_as_number->nb_add((PyObject *)v, (PyObject *)w);
@@ -477,7 +478,8 @@ int_sub(PyIntObject *v, PyIntObject *w)
        register long a, b, x;
        CONVERT_TO_LONG(v, a);
        CONVERT_TO_LONG(w, b);
-       x = a - b;
+       /* casts in the line below avoid undefined behaviour on overflow */
+       x = (long)((unsigned long)a - b);
        if ((x^a) >= 0 || (x^~b) >= 0)
                return PyInt_FromLong(x);
        return PyLong_Type.tp_as_number->nb_subtract((PyObject *)v,
@@ -520,7 +522,8 @@ int_mul(PyObject *v, PyObject *w)
 
        CONVERT_TO_LONG(v, a);
        CONVERT_TO_LONG(w, b);
-       longprod = a * b;
+       /* casts in the next line avoid undefined behaviour on overflow */
+       longprod = (long)((unsigned long)a * b);
        doubleprod = (double)a * (double)b;
        doubled_longprod = (double)longprod;
 

diff --git a/Python/ceval.c b/Python/ceval.c
index abe157e5c154dfad82d0807a8ffbaa6850a0f54d..6c71c27350384980d188e4bb9fdfd065e54b0fa4 100644 (file)
--- a/Python/ceval.c
+++ b/Python/ceval.c
@@ -1191,7 +1191,9 @@ PyEval_EvalFrameEx(PyFrameObject *f, int throwflag)
                                register long a, b, i;
                                a = PyInt_AS_LONG(v);
                                b = PyInt_AS_LONG(w);
-                               i = a + b;
+                               /* cast to avoid undefined behaviour
+                                  on overflow */
+                               i = (long)((unsigned long)a + b);
                                if ((i^a) < 0 && (i^b) < 0)
                                        goto slow_add;
                                x = PyInt_FromLong(i);
@@ -1221,7 +1223,9 @@ PyEval_EvalFrameEx(PyFrameObject *f, int throwflag)
                                register long a, b, i;
                                a = PyInt_AS_LONG(v);
                                b = PyInt_AS_LONG(w);
-                               i = a - b;
+                               /* cast to avoid undefined behaviour
+                                  on overflow */
+                               i = (long)((unsigned long)a - b);
                                if ((i^a) < 0 && (i^~b) < 0)
                                        goto slow_sub;
                                x = PyInt_FromLong(i);