From da5ecd042b53455ac3098379625ce6fa1c2f59b5 Mon Sep 17 00:00:00 2001 From: Zackery Spytz Date: Mon, 27 May 2019 18:00:49 -0600 Subject: [PATCH 1/2] bpo-26423: Fix possible overflow in wrap_lenfunc() --- Lib/test/test_descr.py | 4 ++++ .../2019-05-27-18-00-19.bpo-26423.RgUOE8.rst | 1 + Objects/typeobject.c | 2 +- 3 files changed, 6 insertions(+), 1 deletion(-) create mode 100644 Misc/NEWS.d/next/Core and Builtins/2019-05-27-18-00-19.bpo-26423.RgUOE8.rst diff --git a/Lib/test/test_descr.py b/Lib/test/test_descr.py index e37a98417f505cb..6b018ccc56fa1d3 100644 --- a/Lib/test/test_descr.py +++ b/Lib/test/test_descr.py @@ -389,6 +389,10 @@ def foo(self): return 1 a.setstate(100) self.assertEqual(a.getstate(), 100) + def test_wrap_lenfunc_bad_cast(self): + self.assertEqual(range(sys.maxsize).__len__(), sys.maxsize) + + class ClassPropertiesAndMethods(unittest.TestCase): def assertHasAttr(self, obj, name): diff --git a/Misc/NEWS.d/next/Core and Builtins/2019-05-27-18-00-19.bpo-26423.RgUOE8.rst b/Misc/NEWS.d/next/Core and Builtins/2019-05-27-18-00-19.bpo-26423.RgUOE8.rst new file mode 100644 index 000000000000000..7b9e086b1615682 --- /dev/null +++ b/Misc/NEWS.d/next/Core and Builtins/2019-05-27-18-00-19.bpo-26423.RgUOE8.rst @@ -0,0 +1 @@ +Fix possible overflow in ``wrap_lenfunc()``. diff --git a/Objects/typeobject.c b/Objects/typeobject.c index fc809d36e10be0c..590c109efdaee4a 100644 --- a/Objects/typeobject.c +++ b/Objects/typeobject.c @@ -5527,7 +5527,7 @@ wrap_lenfunc(PyObject *self, PyObject *args, void *wrapped) res = (*func)(self); if (res == -1 && PyErr_Occurred()) return NULL; - return PyLong_FromLong((long)res); + return PyLong_FromSsize_t(res); } static PyObject * From ca4b50888fa1872f3e0d7ba09c87716ff3912e80 Mon Sep 17 00:00:00 2001 From: Zackery Spytz Date: Tue, 28 May 2019 06:28:41 -0600 Subject: [PATCH 2/2] Add more detail to the news entry. --- .../Core and Builtins/2019-05-27-18-00-19.bpo-26423.RgUOE8.rst | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/Misc/NEWS.d/next/Core and Builtins/2019-05-27-18-00-19.bpo-26423.RgUOE8.rst b/Misc/NEWS.d/next/Core and Builtins/2019-05-27-18-00-19.bpo-26423.RgUOE8.rst index 7b9e086b1615682..6bf2031a338488e 100644 --- a/Misc/NEWS.d/next/Core and Builtins/2019-05-27-18-00-19.bpo-26423.RgUOE8.rst +++ b/Misc/NEWS.d/next/Core and Builtins/2019-05-27-18-00-19.bpo-26423.RgUOE8.rst @@ -1 +1,2 @@ -Fix possible overflow in ``wrap_lenfunc()``. +Fix possible overflow in ``wrap_lenfunc()`` when +``sizeof(long) < sizeof(Py_ssize_t)`` (e.g., 64-bit Windows).