From: Mark Dickinson <dickinsm@gmail.com>
Date: Wed, 2 Dec 2009 17:33:41 +0000 (+0000)
Subject: Issue #7406:  Fix some occurrences of potential signed overflow in int
X-Git-Tag: v2.7a1~14
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=34398184eb241dcc42ae0ed117c8be6e7a445495;p=python

Issue #7406:  Fix some occurrences of potential signed overflow in int
arithmetic.
---

diff --git a/Objects/intobject.c b/Objects/intobject.c
index dce569a6ef..43dedf2548 100644
--- a/Objects/intobject.c
+++ b/Objects/intobject.c
@@ -461,7 +461,8 @@ int_add(PyIntObject *v, PyIntObject *w)
 	register long a, b, x;
 	CONVERT_TO_LONG(v, a);
 	CONVERT_TO_LONG(w, b);
-	x = a + b;
+	/* casts in the line below avoid undefined behaviour on overflow */
+	x = (long)((unsigned long)a + b);
 	if ((x^a) >= 0 || (x^b) >= 0)
 		return PyInt_FromLong(x);
 	return PyLong_Type.tp_as_number->nb_add((PyObject *)v, (PyObject *)w);
@@ -473,7 +474,8 @@ int_sub(PyIntObject *v, PyIntObject *w)
 	register long a, b, x;
 	CONVERT_TO_LONG(v, a);
 	CONVERT_TO_LONG(w, b);
-	x = a - b;
+	/* casts in the line below avoid undefined behaviour on overflow */
+	x = (long)((unsigned long)a - b);
 	if ((x^a) >= 0 || (x^~b) >= 0)
 		return PyInt_FromLong(x);
 	return PyLong_Type.tp_as_number->nb_subtract((PyObject *)v,
@@ -516,7 +518,8 @@ int_mul(PyObject *v, PyObject *w)
 
 	CONVERT_TO_LONG(v, a);
 	CONVERT_TO_LONG(w, b);
-	longprod = a * b;
+	/* casts in the next line avoid undefined behaviour on overflow */
+	longprod = (long)((unsigned long)a * b);
 	doubleprod = (double)a * (double)b;
 	doubled_longprod = (double)longprod;
 
diff --git a/Python/ceval.c b/Python/ceval.c
index dd820f2985..e5e70463f7 100644
--- a/Python/ceval.c
+++ b/Python/ceval.c
@@ -1321,7 +1321,9 @@ PyEval_EvalFrameEx(PyFrameObject *f, int throwflag)
 				register long a, b, i;
 				a = PyInt_AS_LONG(v);
 				b = PyInt_AS_LONG(w);
-				i = a + b;
+				/* cast to avoid undefined behaviour
+				   on overflow */
+				i = (long)((unsigned long)a + b);
 				if ((i^a) < 0 && (i^b) < 0)
 					goto slow_add;
 				x = PyInt_FromLong(i);
@@ -1351,7 +1353,9 @@ PyEval_EvalFrameEx(PyFrameObject *f, int throwflag)
 				register long a, b, i;
 				a = PyInt_AS_LONG(v);
 				b = PyInt_AS_LONG(w);
-				i = a - b;
+				/* cast to avoid undefined behaviour
+				   on overflow */
+				i = (long)((unsigned long)a - b);
 				if ((i^a) < 0 && (i^~b) < 0)
 					goto slow_sub;
 				x = PyInt_FromLong(i);