From: Mark Dickinson <dickinsm@gmail.com>
Date: Sun, 21 Aug 2016 07:55:15 +0000 (+0100)
Subject: Issue #27662: don't use PY_SIZE_MAX for overflow checking in List_New. Patch by Xiang... 
X-Git-Tag: v3.6.0b1~617
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=5d13238f6ef4639948bb80b8d2e3bbc9a65de9d8;p=python

Issue #27662: don't use PY_SIZE_MAX for overflow checking in List_New. Patch by Xiang Zhang.
---

diff --git a/Objects/listobject.c b/Objects/listobject.c
index 0b2c8c1dc2..35a49dad80 100644
--- a/Objects/listobject.c
+++ b/Objects/listobject.c
@@ -140,7 +140,6 @@ PyObject *
 PyList_New(Py_ssize_t size)
 {
     PyListObject *op;
-    size_t nbytes;
 #ifdef SHOW_ALLOC_COUNT
     static int initialized = 0;
     if (!initialized) {
@@ -153,11 +152,6 @@ PyList_New(Py_ssize_t size)
         PyErr_BadInternalCall();
         return NULL;
     }
-    /* Check for overflow without an actual overflow,
-     *  which can cause compiler to optimise out */
-    if ((size_t)size > PY_SIZE_MAX / sizeof(PyObject *))
-        return PyErr_NoMemory();
-    nbytes = size * sizeof(PyObject *);
     if (numfree) {
         numfree--;
         op = free_list[numfree];
@@ -176,12 +170,11 @@ PyList_New(Py_ssize_t size)
     if (size <= 0)
         op->ob_item = NULL;
     else {
-        op->ob_item = (PyObject **) PyMem_MALLOC(nbytes);
+        op->ob_item = (PyObject **) PyMem_Calloc(size, sizeof(PyObject *));
         if (op->ob_item == NULL) {
             Py_DECREF(op);
             return PyErr_NoMemory();
         }
-        memset(op->ob_item, 0, nbytes);
     }
     Py_SIZE(op) = size;
     op->allocated = size;
@@ -2503,9 +2496,6 @@ list_ass_subscript(PyListObject* self, PyObject* item, PyObject* value)
                 step = -step;
             }
 
-            assert((size_t)slicelength <=
-                   PY_SIZE_MAX / sizeof(PyObject*));
-
             garbage = (PyObject**)
                 PyMem_MALLOC(slicelength*sizeof(PyObject*));
             if (!garbage) {