PyLong_AsLongAndOverflow does not guarantee overflow is -1 when value is -1

[yijan4845]

Bug report

Bug description:

In the function pylong_aslongandoverflow

cpython/Modules/_testlimitedcapi/long.c

Lines 621 to 632 in 3929af5

	static PyObject *
	pylong_aslongandoverflow(PyObject *module, PyObject *arg)
	{
	NULLABLE(arg);
	int overflow = UNINITIALIZED_INT;
	long value = PyLong_AsLongAndOverflow(arg, &overflow);
	if (value == -1 && PyErr_Occurred()) {
	assert(overflow == -1);
	return NULL;
	}
	return Py_BuildValue("li", value, overflow);
	}

there is an assertion overflow == -1 when value == -1. But this is not always true, like if arg is NULL.

Reproduce:

from test.support import import_helper

_testlimitedcapi = import_helper.import_module('_testlimitedcapi')

aslonglongandoverflow = _testlimitedcapi.pylong_aslonglongandoverflow
aslonglongandoverflow(None)

Result:

python: ../Modules/_testlimitedcapi/long.c:674: pylong_aslonglongandoverflow: Assertion `overflow == -1' failed.

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux

Linked PRs

• gh-130824: Add tests for NULL in PyLong_*AndOverflow functions #130828
• [3.13] gh-130824: Add tests for NULL in PyLong_*AndOverflow functions (GH-130828) #130869
• gh-130824: Clean up test wrappers for PyLong_*AndOverflow functions #130871
• [3.12] gh-130824: Add tests for NULL in PyLong_*AndOverflow functions (GH-130828) #130876

[ZeroIntensity]

That would be because passing None to pylong_aslongandoverflow changes the argument to NULL, so a SystemError is raised by PyLong_AsLongAndOverflow, which the test function wasn't expecting.

This is documented:

If any other exception occurs set *overflow to 0 and return -1 as usual.

overflow is indeed getting set to 0 here, not -1, so the assertion is wrong. It's fine to fix this specific case since we're already here, but I'm assuming you're doing some fuzzing. That's fine--we're happy to fix edge cases--but please try to keep the fuzzing in the standard library, not our test suite (so no more fuzzing on the test module, please!)

[yijan4845]

That would be because passing None to pylong_aslongandoverflow changes the argument to NULL, so a SystemError is raised by PyLong_AsLongAndOverflow, which the test function wasn't expecting.

This is documented:

If any other exception occurs set *overflow to 0 and return -1 as usual.

overflow is indeed getting set to 0 here, not -1, so the assertion is wrong. It's fine to fix this specific case since we're already here, but I'm assuming you're doing some fuzzing. That's fine--we're happy to fix edge cases--but please try to keep the fuzzing in the standard library, not our test suite (so no more fuzzing on the test module, please!)

I understand. I'll make sure to focus my fuzzing efforts on the standard library as much as possible. Thanks for the clarification!