Issue #16096: Fix signed overflow in Objects/longobject.c. Thanks Serhiy Storchaka.

diff --git a/Objects/longobject.c b/Objects/longobject.c
index 73413dd5afb3ae2b272275ce5c1f6c909c048550..4cc080f2b5da5676729f993c427febe400f674d5 100644 (file)
--- a/Objects/longobject.c
+++ b/Objects/longobject.c
@@ -668,10 +668,9 @@ _PyLong_NumBits(PyObject *vv)
     assert(ndigits == 0 || v->ob_digit[ndigits - 1] != 0);
     if (ndigits > 0) {
         digit msd = v->ob_digit[ndigits - 1];
-
-        result = (ndigits - 1) * PyLong_SHIFT;
-        if (result / PyLong_SHIFT != (size_t)(ndigits - 1))
+        if ((size_t)(ndigits - 1) > PY_SIZE_MAX / (size_t)PyLong_SHIFT)
             goto Overflow;
+        result = (size_t)(ndigits - 1) * (size_t)PyLong_SHIFT;
         do {
             ++result;
             if (result == 0)