commit b93d8637a6bce5b1b61423dc6c8319fc82a31b13
author Martin Panter <vadmium+py@gmail.com> Mon Jul 25 02:39:20 2016 +0000
committer Martin Panter <vadmium+py@gmail.com> Mon Jul 25 02:39:20 2016 +0000
tree 2bf465e8c89e54dc4989f126b7b8c20008e455a9
parent 32d2ce3561088eb0fbb3e63e9fcbc3a90491604a

Issue #1621: Avoid signed overflow in list and tuple operations

Patch by Xiang Zhang.

Objects/tupleobject.c

diff --git a/Objects/tupleobject.c b/Objects/tupleobject.c
index 1b41258..c0ff499 100644
--- a/Objects/tupleobject.c
+++ b/Objects/tupleobject.c
@@ -453,9 +453,9 @@
         return NULL;
     }
 #define b ((PyTupleObject *)bb)
-    size = Py_SIZE(a) + Py_SIZE(b);
-    if (size < 0)
+    if (Py_SIZE(a) > PY_SSIZE_T_MAX - Py_SIZE(b))
         return PyErr_NoMemory();
+    size = Py_SIZE(a) + Py_SIZE(b);
     np = (PyTupleObject *) PyTuple_New(size);
     if (np == NULL) {
         return NULL;