diff -r e72aab080165 Lib/test/list_tests.py --- a/Lib/test/list_tests.py Sat Jul 23 11:16:56 2016 -0400 +++ b/Lib/test/list_tests.py Sun Jul 24 21:30:40 2016 +0800 @@ -266,8 +266,20 @@ self.assertEqual(a, list("spameggs")) self.assertRaises(TypeError, a.extend, None) + self.assertRaises(TypeError, a.extend) - self.assertRaises(TypeError, a.extend) + # overflow test. issue1621 + class CustomIter: + def __iter__(self): + return self + def __next__(self): + raise StopIteration + def __length_hint__(self): + return sys.maxsize + a = self.type2test([1,2,3,4]) + a.extend(CustomIter()) + self.assertEqual(a, [1,2,3,4]) + def test_insert(self): a = self.type2test([0, 1, 2]) diff -r e72aab080165 Objects/listobject.c --- a/Objects/listobject.c Sat Jul 23 11:16:56 2016 -0400 +++ b/Objects/listobject.c Sun Jul 24 21:30:40 2016 +0800 @@ -488,9 +488,9 @@ return NULL; } #define b ((PyListObject *)bb) + if (Py_SIZE(a) > PY_SSIZE_T_MAX - Py_SIZE(b)) + return PyErr_NoMemory(); size = Py_SIZE(a) + Py_SIZE(b); - if (size < 0) - return PyErr_NoMemory(); np = (PyListObject *) PyList_New(size); if (np == NULL) { return NULL; @@ -841,18 +841,20 @@ return NULL; } m = Py_SIZE(self); - mn = m + n; - if (mn >= m) { + if (m > PY_SSIZE_T_MAX - n) { + /* m + n overflowed; on the chance that n lied, and there really + * is enough room, ignore it. If n was telling the truth, we'll + * eventually run out of memory during the loop. + */ + } + else { + mn = m + n; /* Make room. */ if (list_resize(self, mn) < 0) goto error; /* Make the list sane again. */ Py_SIZE(self) = m; } - /* Else m + n overflowed; on the chance that n lied, and there really - * is enough room, ignore it. If n was telling the truth, we'll - * eventually run out of memory during the loop. - */ /* Run iterator to exhaustion. */ for (;;) { diff -r e72aab080165 Objects/tupleobject.c --- a/Objects/tupleobject.c Sat Jul 23 11:16:56 2016 -0400 +++ b/Objects/tupleobject.c Sun Jul 24 21:30:40 2016 +0800 @@ -453,9 +453,9 @@ return NULL; } #define b ((PyTupleObject *)bb) + if (Py_SIZE(a) > PY_SSIZE_T_MAX - Py_SIZE(b)) + return PyErr_NoMemory(); size = Py_SIZE(a) + Py_SIZE(b); - if (size < 0) - return PyErr_NoMemory(); np = (PyTupleObject *) PyTuple_New(size); if (np == NULL) { return NULL;