There is a potential signed integer overflow in the expression:

This occurs in the loop:

len is derived from a Py_SIZE cast, and it can possibly be INT_MAX:

It means that sum can theoretically exceed INT_MAX if len is near the limit, triggering undefined behavior due to signed integer overflow.

Linked PRs

• gh-132771: Fixed potential Integer Overflow in mark_stacks function #132773
• gh-132771: Added assert for potential Integer Overflow in the mark_stacks function #132830