[Python-checkins] bpo-26423: Fix possible overflow in wrap_lenfunc() (GH-13606) (GH-13625)

[Victor Stinner]

https://github.com/python/cpython/commit/80dfe990162e7a2dd99524829beecd449a973e9e
commit: 80dfe990162e7a2dd99524829beecd449a973e9e
branch: 2.7
author: Victor Stinner <vstinner at redhat.com>
committer: GitHub <noreply at github.com>
date: 2019-05-28T17:23:07+02:00
summary:

bpo-26423: Fix possible overflow in wrap_lenfunc() (GH-13606) (GH-13625)

Fix possible overflow in wrap_lenfunc() when
sizeof(long) < sizeof(Py_ssize_t) (e.g., 64-bit Windows).

(cherry picked from commit 05f16416d99dc9fc76fef11e56f16593e7a5955e)

files:
A Misc/NEWS.d/next/Core and Builtins/2019-05-27-18-00-19.bpo-26423.RgUOE8.rst
M Lib/test/test_descr.py
M Objects/typeobject.c

diff --git a/Lib/test/test_descr.py b/Lib/test/test_descr.py
index bbc52aa67913..9b8b8a4b33fa 100644
--- a/Lib/test/test_descr.py
+++ b/Lib/test/test_descr.py
@@ -403,6 +403,10 @@ def foo(self): return 1
         a.setstate(100)
         self.assertEqual(a.getstate(), 100)
 
+    def test_wrap_lenfunc_bad_cast(self):
+        self.assertEqual(xrange(sys.maxsize).__len__(), sys.maxsize)
+
+
 class ClassPropertiesAndMethods(unittest.TestCase):
 
     def assertHasAttr(self, obj, name):
diff --git a/Misc/NEWS.d/next/Core and Builtins/2019-05-27-18-00-19.bpo-26423.RgUOE8.rst b/Misc/NEWS.d/next/Core and Builtins/2019-05-27-18-00-19.bpo-26423.RgUOE8.rst
new file mode 100644
index 000000000000..6bf2031a3384
--- /dev/null
+++ b/Misc/NEWS.d/next/Core and Builtins/2019-05-27-18-00-19.bpo-26423.RgUOE8.rst	
@@ -0,0 +1,2 @@
+Fix possible overflow in ``wrap_lenfunc()`` when
+``sizeof(long) < sizeof(Py_ssize_t)`` (e.g., 64-bit Windows).
diff --git a/Objects/typeobject.c b/Objects/typeobject.c
index 56277cfc35ec..1c8958c49a3b 100644
--- a/Objects/typeobject.c
+++ b/Objects/typeobject.c
@@ -4398,7 +4398,7 @@ wrap_lenfunc(PyObject *self, PyObject *args, void *wrapped)
     res = (*func)(self);
     if (res == -1 && PyErr_Occurred())
         return NULL;
-    return PyInt_FromLong((long)res);
+    return PyInt_FromSsize_t(res);
 }
 
 static PyObject *