Correct overflow check in PyTuple_New() (GH-14838)

sir-sigurd · Yhg1s · commit 755d4ef82430 · 2019-09-09T13:40:58.000-07:00
diff --git a/Objects/tupleobject.c b/Objects/tupleobject.c
@@ -120,8 +120,8 @@ tuple_alloc(Py_ssize_t size)
 #endif
     {
         /* Check for overflow */
-        if ((size_t)size > ((size_t)PY_SSIZE_T_MAX - sizeof(PyTupleObject) -
-                    sizeof(PyObject *)) / sizeof(PyObject *)) {
+        if ((size_t)size > ((size_t)PY_SSIZE_T_MAX - (sizeof(PyTupleObject) -
+                    sizeof(PyObject *))) / sizeof(PyObject *)) {
             return (PyTupleObject *)PyErr_NoMemory();
         }
         op = PyObject_GC_NewVar(PyTupleObject, &PyTuple_Type, size);

Original file line number	Diff line number	Diff line change
`@@ -120,8 +120,8 @@ tuple_alloc(Py_ssize_t size)`
`120`	`120`	`#endif`
`121`	`121`	`{`
`122`	`122`	`/* Check for overflow */`
`123`		`- if ((size_t)size > ((size_t)PY_SSIZE_T_MAX - sizeof(PyTupleObject) -`
`124`		`- sizeof(PyObject )) / sizeof(PyObject )) {`
	`123`	`+ if ((size_t)size > ((size_t)PY_SSIZE_T_MAX - (sizeof(PyTupleObject) -`
	`124`	`+ sizeof(PyObject ))) / sizeof(PyObject )) {`
`125`	`125`	`return (PyTupleObject *)PyErr_NoMemory();`
`126`	`126`	`}`
`127`	`127`	`op = PyObject_GC_NewVar(PyTupleObject, &PyTuple_Type, size);`