diff -r a28abe83cf5c Objects/listobject.c --- a/Objects/listobject.c Sat Jul 23 08:43:04 2016 +0300 +++ b/Objects/listobject.c Sat Jul 23 22:49:00 2016 +0800 @@ -488,9 +488,9 @@ return NULL; } #define b ((PyListObject *)bb) + if (Py_SIZE(a) > PY_SSIZE_T_MAX - Py_SIZE(b)) + return PyErr_NoMemory(); size = Py_SIZE(a) + Py_SIZE(b); - if (size < 0) - return PyErr_NoMemory(); np = (PyListObject *) PyList_New(size); if (np == NULL) { return NULL; @@ -841,18 +841,20 @@ return NULL; } m = Py_SIZE(self); - mn = m + n; - if (mn >= m) { + if (m > PY_SSIZE_T_MAX - n) { + /* m + n overflowed; on the chance that n lied, and there really + * is enough room, ignore it. If n was telling the truth, we'll + * eventually run out of memory during the loop. + */ + } + else { + mn = m + n; /* Make room. */ if (list_resize(self, mn) < 0) goto error; /* Make the list sane again. */ Py_SIZE(self) = m; } - /* Else m + n overflowed; on the chance that n lied, and there really - * is enough room, ignore it. If n was telling the truth, we'll - * eventually run out of memory during the loop. - */ /* Run iterator to exhaustion. */ for (;;) { diff -r a28abe83cf5c Objects/tupleobject.c --- a/Objects/tupleobject.c Sat Jul 23 08:43:04 2016 +0300 +++ b/Objects/tupleobject.c Sat Jul 23 22:49:00 2016 +0800 @@ -453,9 +453,9 @@ return NULL; } #define b ((PyTupleObject *)bb) + if (Py_SIZE(a) > PY_SSIZE_T_MAX - Py_SIZE(b)) + return PyErr_NoMemory(); size = Py_SIZE(a) + Py_SIZE(b); - if (size < 0) - return PyErr_NoMemory(); np = (PyTupleObject *) PyTuple_New(size); if (np == NULL) { return NULL;