diff -r 58ebfa7c1361 Lib/test/test_descr.py --- a/Lib/test/test_descr.py Mon Feb 15 16:51:24 2016 +1100 +++ b/Lib/test/test_descr.py Wed Feb 24 14:46:46 2016 +0100 @@ -396,6 +396,25 @@ class OperatorsTest(unittest.TestCase): a.setstate(100) self.assertEqual(a.getstate(), 100) + @test_support.precisionbigmemtest(2**31+5, 1) + def test_wrap_lenfunc_overflow(self, maxsize): + # Issue #26423: check for integer overflow in wrap_lenfunc() + # for length larger than 2^31 bytes (2 GB) + try: + data = b'x' * maxsize + + # call wrap_lenfunc() + data_len = data.__len__() + self.assertEqual(data_len, maxsize) + + # try also directly len(obj), just in case + self.assertEqual(len(data), maxsize) + finally: + # Ensure that memory is released + data = None + test_support.gc_collect() + + class ClassPropertiesAndMethods(unittest.TestCase): def assertHasAttr(self, obj, name): diff -r 58ebfa7c1361 Objects/typeobject.c --- a/Objects/typeobject.c Mon Feb 15 16:51:24 2016 +1100 +++ b/Objects/typeobject.c Wed Feb 24 14:46:46 2016 +0100 @@ -4303,7 +4303,7 @@ wrap_lenfunc(PyObject *self, PyObject *a res = (*func)(self); if (res == -1 && PyErr_Occurred()) return NULL; - return PyInt_FromLong((long)res); + return PyInt_FromSsize_t(res); } static PyObject *