@@ -267,7 +267,13 @@ array_resize(arrayobject *self, Py_ssize_t newsize)
267267 * memory critical.
268268 */
269269
270- size_t _new_size = (newsize >> 4 ) + (Py_SIZE (self ) < 8 ? 3 : 7 ) + newsize ;
270+ size_t _new_size = (size_t )(newsize >> 4 ) + (Py_SIZE (self ) < 8 ? 3 : 7 ) + newsize ;
271+ // Limit over-allocation to not overflow Py_ssize_t, newsize can't ever be
272+ // larger than this anyway. Otherwise a valid resize request might be
273+ // rejected due to overallocation falling outside usable range.
274+ if (_new_size > PY_SSIZE_T_MAX ) {
275+ _new_size = PY_SSIZE_T_MAX ;
276+ }
271277 int itemsize = self -> ob_descr -> itemsize ;
272278
273279 if (!arraydata_size_valid (_new_size , itemsize )) {
@@ -2077,6 +2083,7 @@ static PyObject *
20772083array_array_tobytes_impl (arrayobject * self )
20782084/*[clinic end generated code: output=87318e4edcdc2bb6 input=c4d44d5499d2320f]*/
20792085{
2086+ // XXX This check below does nothing useful???
20802087 if (arraydata_size_valid (Py_SIZE (self ), self -> ob_descr -> itemsize )) {
20812088 return PyBytes_FromStringAndSize (array_items_ptr (self ),
20822089 Py_SIZE (self ) * self -> ob_descr -> itemsize );
@@ -2117,7 +2124,7 @@ array_array_fromunicode_impl(arrayobject *self, PyObject *ustr)
21172124 if (ustr_length > 1 ) {
21182125 ustr_length -- ; /* trim trailing NUL character */
21192126 Py_ssize_t old_size = Py_SIZE (self );
2120- Py_ssize_t new_size = old_size + ustr_length ;
2127+ ssize_t new_size = ( size_t ) old_size + ustr_length ;
21212128
21222129 if (!arraydata_size_valid (new_size , sizeof (wchar_t ))) {
21232130 return PyErr_NoMemory ();
@@ -2134,7 +2141,7 @@ array_array_fromunicode_impl(arrayobject *self, PyObject *ustr)
21342141 else { // typecode == 'w'
21352142 Py_ssize_t ustr_length = PyUnicode_GetLength (ustr );
21362143 Py_ssize_t old_size = Py_SIZE (self );
2137- Py_ssize_t new_size = old_size + ustr_length ;
2144+ ssize_t new_size = ( size_t ) old_size + ustr_length ;
21382145
21392146 if (!arraydata_size_valid (new_size , sizeof (Py_UCS4 ))) {
21402147 return PyErr_NoMemory ();
0 commit comments