[Python-checkins] bpo-36946:Fix possible signed integer overflow when handling slices. (GH-15639)

[Miss Islington (bot)]

https://github.com/python/cpython/commit/021e5db20bc19d678a5b94247a5cdcf689eff006
commit: 021e5db20bc19d678a5b94247a5cdcf689eff006
branch: 3.7
author: Miss Islington (bot) <31488909+miss-islington at users.noreply.github.com>
committer: GitHub <noreply at github.com>
date: 2019-09-08T03:36:38-07:00
summary:

bpo-36946:Fix possible signed integer overflow when handling slices. (GH-15639)


This is a complement to PR 13375.
(cherry picked from commit 3c87a667bb367ace1de6bd1577fdb4f66947da52)

Co-authored-by: HongWeipeng <hongweichen8888 at sina.com>

files:
A Misc/NEWS.d/next/Core and Builtins/2019-09-02-16-17-42.bpo-36946._lAuSR.rst
M Lib/test/test_list.py
M Modules/_ctypes/_ctypes.c
M Objects/listobject.c

diff --git a/Lib/test/test_list.py b/Lib/test/test_list.py
index def4badbf557..5078d4bc1ced 100644
--- a/Lib/test/test_list.py
+++ b/Lib/test/test_list.py
@@ -149,6 +149,11 @@ def test_reversed_pickle(self):
             a[:] = data
             self.assertEqual(list(it), [])
 
+    def test_step_overflow(self):
+        a = [0, 1, 2, 3, 4]
+        a[1::sys.maxsize] = [0]
+        self.assertEqual(a[3::sys.maxsize], [3])
+
     def test_no_comdat_folding(self):
         # Issue 8847: In the PGO build, the MSVC linker's COMDAT folding
         # optimization causes failures in code that relies on distinct
diff --git a/Misc/NEWS.d/next/Core and Builtins/2019-09-02-16-17-42.bpo-36946._lAuSR.rst b/Misc/NEWS.d/next/Core and Builtins/2019-09-02-16-17-42.bpo-36946._lAuSR.rst
new file mode 100644
index 000000000000..e0c5d712f001
--- /dev/null
+++ b/Misc/NEWS.d/next/Core and Builtins/2019-09-02-16-17-42.bpo-36946._lAuSR.rst	
@@ -0,0 +1 @@
+Fix possible signed integer overflow when handling slices. Patch by hongweipeng.
diff --git a/Modules/_ctypes/_ctypes.c b/Modules/_ctypes/_ctypes.c
index 8fa662755261..8008a481e275 100644
--- a/Modules/_ctypes/_ctypes.c
+++ b/Modules/_ctypes/_ctypes.c
@@ -5019,7 +5019,8 @@ Pointer_subscript(PyObject *myself, PyObject *item)
         PyObject *np;
         StgDictObject *stgdict, *itemdict;
         PyObject *proto;
-        Py_ssize_t i, len, cur;
+        Py_ssize_t i, len;
+        size_t cur;
 
         /* Since pointers have no length, and we want to apply
            different semantics to negative indices than normal
diff --git a/Objects/listobject.c b/Objects/listobject.c
index 78aa8dea08ac..c5e7553efcf9 100644
--- a/Objects/listobject.c
+++ b/Objects/listobject.c
@@ -2729,7 +2729,8 @@ list_subscript(PyListObject* self, PyObject* item)
         return list_item(self, i);
     }
     else if (PySlice_Check(item)) {
-        Py_ssize_t start, stop, step, slicelength, cur, i;
+        Py_ssize_t start, stop, step, slicelength, i;
+        size_t cur;
         PyObject* result;
         PyObject* it;
         PyObject **src, **dest;
@@ -2865,7 +2866,8 @@ list_ass_subscript(PyListObject* self, PyObject* item, PyObject* value)
             /* assign slice */
             PyObject *ins, *seq;
             PyObject **garbage, **seqitems, **selfitems;
-            Py_ssize_t cur, i;
+            Py_ssize_t i;
+            size_t cur;
 
             /* protect against a[::-1] = a */
             if (self == (PyListObject*)value) {