Add checks for size overflow on list*n, list+list, tuple+tuple.

Will backport.

diff --git a/Objects/listobject.c b/Objects/listobject.c
index 64de38bcb326eb65866d08c020aad692b9163be5..2cb08d316658965147da4e2fed5f8e6190100810 100644 (file)
--- a/Objects/listobject.c
+++ b/Objects/listobject.c
@@ -391,6 +391,8 @@ list_concat(PyListObject *a, PyObject *bb)
        }
 #define b ((PyListObject *)bb)
        size = a->ob_size + b->ob_size;
+       if (size < 0)
+               return PyErr_NoMemory();
        np = (PyListObject *) PyList_New(size);
        if (np == NULL) {
                return NULL;
@@ -419,6 +421,8 @@ list_repeat(PyListObject *a, int n)
        if (n < 0)
                n = 0;
        size = a->ob_size * n;
+       if (size/a->ob_size != n)
+               return PyErr_NoMemory();
        np = (PyListObject *) PyList_New(size);
        if (np == NULL)
                return NULL;

diff --git a/Objects/tupleobject.c b/Objects/tupleobject.c
index 6c2162aa691cc9098a8d0bcd030ef60fa5979ac9..3a8f072a263770f704985442dc481e39db35388a 100644 (file)
--- a/Objects/tupleobject.c
+++ b/Objects/tupleobject.c
@@ -330,6 +330,8 @@ tupleconcat(register PyTupleObject *a, register PyObject *bb)
        }
 #define b ((PyTupleObject *)bb)
        size = a->ob_size + b->ob_size;
+       if (size < 0)
+               return PyErr_NoMemory();
        np = (PyTupleObject *) PyTuple_New(size);
        if (np == NULL) {
                return NULL;