bpo-36504: Fix signed integer overflow in _ctypes.c's PyCArrayType_new(). (GH-12660)

ZackerySpytz · serhiy-storchaka · commit 487b73ab39c8 · 2019-04-02T13:47:51.000+03:00
diff --git a/Lib/ctypes/test/test_arrays.py b/Lib/ctypes/test/test_arrays.py
@@ -197,6 +197,12 @@ class T(Array):
             _type_ = c_int
             _length_ = 0
 
+    def test_bpo36504_signed_int_overflow(self):
+        # The overflow check in PyCArrayType_new() could cause signed integer
+        # overflow.
+        with self.assertRaises(OverflowError):
+            c_char * sys.maxsize * 2
+
     @unittest.skipUnless(sys.maxsize > 2**32, 'requires 64bit platform')
     @bigmemtest(size=_2G, memuse=1, dry_run=False)
     def test_large_array(self, size):
diff --git a/Misc/NEWS.d/next/Core and Builtins/2019-04-02-04-10-32.bpo-36504.k_V8Bm.rst b/Misc/NEWS.d/next/Core and Builtins/2019-04-02-04-10-32.bpo-36504.k_V8Bm.rst
@@ -0,0 +1 @@
+Fix signed integer overflow in _ctypes.c's ``PyCArrayType_new()``.
diff --git a/Modules/_ctypes/_ctypes.c b/Modules/_ctypes/_ctypes.c
@@ -1518,7 +1518,7 @@ PyCArrayType_new(PyTypeObject *type, PyObject *args, PyObject *kwds)
     }
 
     itemsize = itemdict->size;
-    if (length * itemsize < 0) {
+    if (length > PY_SSIZE_T_MAX / itemsize) {
         PyErr_SetString(PyExc_OverflowError,
                         "array too large");
         goto error;

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1 @@`
	`1`	+Fix signed integer overflow in _ctypes.c's ``PyCArrayType_new()``.
Original file line number	Diff line number	Diff line change
`@@ -1518,7 +1518,7 @@ PyCArrayType_new(PyTypeObject type, PyObject args, PyObject *kwds)`
`1518`	`1518`	`}`
`1519`	`1519`
`1520`	`1520`	`itemsize = itemdict->size;`
`1521`		`- if (length * itemsize < 0) {`
	`1521`	`+ if (length > PY_SSIZE_T_MAX / itemsize) {`
`1522`	`1522`	`PyErr_SetString(PyExc_OverflowError,`
`1523`	`1523`	`"array too large");`
`1524`	`1524`	`goto error;`