Overflow in parsing 'float' parameters in PyArg_ParseTuple*

Python/getargs.c

 
 /* New getargs implementation */
 
 #include "Python.h"
 
 #include <ctype.h>
+#include <float.h>
 
 
 #ifdef __cplusplus
 extern "C" {
 #endif
 int PyArg_Parse(PyObject *, const char *, ...);
 int PyArg_ParseTuple(PyObject *, const char *, ...);
 int PyArg_VaParse(PyObject *, const char *, va_list);
 
 int PyArg_ParseTupleAndKeywords(PyObject *, PyObject *,
@@ skipping 733 matching lines @@
         *p = ival;
         break;
     }
 #endif
 
     case 'f': {/* float */
         float *p = va_arg(*p_va, float *);
         double dval = PyFloat_AsDouble(arg);
         if (PyErr_Occurred())
             RETURN_ERR_OCCURRED;
-        else
-            *p = (float) dval;
+        if (Py_IS_FINITE(dval)) {
+            if (dval < -FLT_MAX) {
+                PyErr_SetString(PyExc_OverflowError,
+                                "float is less than minimum");
+                RETURN_ERR_OCCURRED;
+            }
+            else if (dval > FLT_MAX) {
+                PyErr_SetString(PyExc_OverflowError,
+                                "float is greater than maximum");
+                RETURN_ERR_OCCURRED;
+            }
+        }
+        *p = (float) dval;
         break;
     }
 
     case 'd': {/* double */
         double *p = va_arg(*p_va, double *);
         double dval = PyFloat_AsDouble(arg);
         if (PyErr_Occurred())
             RETURN_ERR_OCCURRED;
         else
             *p = dval;
@@ skipping 1024 matching lines @@
     if (PyDict_Size(kw) == 0)
         return 1;
 
     PyErr_Format(PyExc_TypeError, "%s does not take keyword arguments",
                     funcname);
     return 0;
 }
 #ifdef __cplusplus
 };
 #endif