Skip to content

Commit 73fa01c

Browse files
committed
Fix overflow
1 parent 1cb2de7 commit 73fa01c

File tree

2 files changed

+9
-2
lines changed

2 files changed

+9
-2
lines changed

Objects/rangeobject.c

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -770,7 +770,7 @@ rangeiter_next(_PyRangeIterObject *r)
770770
/* cast to unsigned to avoid possible signed overflow
771771
in intermediate calculations. */
772772
return PyLong_FromLong((long)(r->start +
773-
(digit)(r->index++) * r->step));
773+
(unsigned long)(r->index++) * r->step));
774774
return NULL;
775775
}
776776

@@ -1190,6 +1190,13 @@ range_reverse(PyObject *seq, PyObject *Py_UNUSED(ignored))
11901190

11911191
new_stop = lstart - lstep;
11921192
new_start = (long)(new_stop + ulen * lstep);
1193+
if (ulen > PyLong_MASK ||
1194+
new_start > PyLong_MASK || new_start < -(long)PyLong_MASK ||
1195+
new_stop > PyLong_MASK || new_stop < -(long)PyLong_MASK ||
1196+
lstep > PyLong_MASK || lstep < -(long)PyLong_MASK)
1197+
{
1198+
goto long_range;
1199+
}
11931200
return fast_range_iter(new_start, new_stop, -lstep, (long)ulen);
11941201

11951202
long_range:

Python/ceval.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4426,7 +4426,7 @@ _PyEval_EvalFrameDefault(PyThreadState *tstate, _PyInterpreterFrame *frame, int
44264426
else {
44274427
assert(value >= -(sdigit)PyLong_MASK);
44284428
((PyLongObject *)local)->ob_digit[0] = -(sdigit)value;
4429-
Py_SET_SIZE(local, -1);
4429+
Py_SET_SIZE(local, (Py_ssize_t)-1);
44304430
}
44314431
NOTRACE_DISPATCH();
44324432
}

0 commit comments

Comments
 (0)