commit 42aa9c078a28f54fd30bf3a9feb3176e42049ca4
author Serhiy Storchaka <storchaka@gmail.com> Tue Feb 03 01:34:09 2015 +0200
committer Serhiy Storchaka <storchaka@gmail.com> Tue Feb 03 01:34:09 2015 +0200
tree 59d09b442591078284913109c2f70eb30696f6f2
parent 77a57c7570fa77ea7ccac72286369b56df8509da

Issues #23363, #23364, #23365, #23366: Fixed itertools overflow tests.
Used PyMem_New to check overflow.

Modules/itertoolsmodule.c

diff --git a/Modules/itertoolsmodule.c b/Modules/itertoolsmodule.c
index b63975c..e5b2b74 100644
--- a/Modules/itertoolsmodule.c
+++ b/Modules/itertoolsmodule.c
@@ -1847,15 +1847,14 @@
         nargs = 0;
     } else {
         nargs = PyTuple_GET_SIZE(args);
-        if (repeat > PY_SSIZE_T_MAX/sizeof(Py_ssize_t) ||
-            nargs > PY_SSIZE_T_MAX/(repeat * sizeof(Py_ssize_t))) {
+        if ((size_t)nargs > PY_SSIZE_T_MAX/sizeof(Py_ssize_t)/repeat) {
             PyErr_SetString(PyExc_OverflowError, "repeat argument too large");
             return NULL;
         }
     }
     npools = nargs * repeat;
 
-    indices = PyMem_Malloc(npools * sizeof(Py_ssize_t));
+    indices = PyMem_New(Py_ssize_t, npools);
     if (indices == NULL) {
         PyErr_NoMemory();
         goto error;
@@ -2102,11 +2101,7 @@
         goto error;
     }
 
-    if (r > PY_SSIZE_T_MAX/sizeof(Py_ssize_t)) {
-        PyErr_SetString(PyExc_OverflowError, "r is too big");
-        goto error;
-    }
-    indices = PyMem_Malloc(r * sizeof(Py_ssize_t));
+    indices = PyMem_New(Py_ssize_t, r);
     if (indices == NULL) {
         PyErr_NoMemory();
         goto error;
@@ -2355,11 +2350,7 @@
         goto error;
     }
 
-    if (r > PY_SSIZE_T_MAX/sizeof(Py_ssize_t)) {
-        PyErr_SetString(PyExc_OverflowError, "r is too big");
-        goto error;
-    }
-    indices = PyMem_Malloc(r * sizeof(Py_ssize_t));
+    indices = PyMem_New(Py_ssize_t, r);
     if (indices == NULL) {
         PyErr_NoMemory();
         goto error;
@@ -2612,13 +2603,8 @@
         goto error;
     }
 
-    if (n > PY_SSIZE_T_MAX/sizeof(Py_ssize_t) ||
-        r > PY_SSIZE_T_MAX/sizeof(Py_ssize_t)) {
-        PyErr_SetString(PyExc_OverflowError, "parameters too large");
-        goto error;
-    }
-    indices = PyMem_Malloc(n * sizeof(Py_ssize_t));
-    cycles = PyMem_Malloc(r * sizeof(Py_ssize_t));
+    indices = PyMem_New(Py_ssize_t, n);
+    cycles = PyMem_New(Py_ssize_t, r);
     if (indices == NULL || cycles == NULL) {
         PyErr_NoMemory();
         goto error;