Issue #15989: Fix several occurrences of integer overflow
when result of PyInt_AsLong() or PyLong_AsLong() narrowed
to int without checks.
This is a backport of changesets 13e2e44db99d and 525407d89277.
diff --git a/Objects/unicodeobject.c b/Objects/unicodeobject.c
index 79e1b60..46bfe2b 100644
--- a/Objects/unicodeobject.c
+++ b/Objects/unicodeobject.c
@@ -8411,7 +8411,9 @@
"* wants int");
goto onError;
}
- width = PyInt_AsLong(v);
+ width = PyInt_AsSsize_t(v);
+ if (width == -1 && PyErr_Occurred())
+ goto onError;
if (width < 0) {
flags |= F_LJUST;
width = -width;
@@ -8446,7 +8448,9 @@
"* wants int");
goto onError;
}
- prec = PyInt_AsLong(v);
+ prec = _PyInt_AsInt(v);
+ if (prec == -1 && PyErr_Occurred())
+ goto onError;
if (prec < 0)
prec = 0;
if (--fmtcnt >= 0)