Issue #1621: Avoid signed int negation overflow in audioop

vadmium · vadmium · commit 6fb90905e2c5 · 2016-07-19T03:05:42.000Z
diff --git a/Misc/NEWS b/Misc/NEWS
@@ -26,6 +26,8 @@ Core and Builtins
 Library
 -------
 
+- Issue #1621: Avoid signed int negation overflow in the "audioop" module.
+
 - Issue #27533: Release GIL in nt._isdir
 
 - Issue #17711: Fixed unpickling by the persistent ID with protocol 0.
diff --git a/Modules/audioop.c b/Modules/audioop.c
@@ -446,7 +446,9 @@ audioop_max_impl(PyObject *module, Py_buffer *fragment, int width)
         return NULL;
     for (i = 0; i < fragment->len; i += width) {
         int val = GETRAWSAMPLE(width, fragment->buf, i);
-        if (val < 0) absval = (-val);
+        /* Cast to unsigned before negating. Unsigned overflow is well-
+        defined, but signed overflow is not. */
+        if (val < 0) absval = -(unsigned int)val;
         else absval = val;
         if (absval > max) max = absval;
     }
