diff -r bc6abb780844 Objects/stringlib/transmogrify.h --- a/Objects/stringlib/transmogrify.h Sun Jan 08 18:22:41 2017 -0800 +++ b/Objects/stringlib/transmogrify.h Mon Jan 09 11:31:39 2017 +0800 @@ -261,7 +261,7 @@ assert(count > 0); if (to_len > (PY_SSIZE_T_MAX - self_len) / count) { PyErr_SetString(PyExc_OverflowError, - "replace bytes are too long"); + "replace bytes is too long"); return NULL; } result_len = count * to_len + self_len; diff -r bc6abb780844 Objects/unicodeobject.c --- a/Objects/unicodeobject.c Sun Jan 08 18:22:41 2017 -0800 +++ b/Objects/unicodeobject.c Mon Jan 09 11:31:39 2017 +0800 @@ -9950,7 +9950,7 @@ use_memcpy = 1; #endif for (i = 0; i < seqlen; i++) { - const Py_ssize_t old_sz = sz; + Py_ssize_t itemlen; item = items[i]; if (!PyUnicode_Check(item)) { PyErr_Format(PyExc_TypeError, @@ -9961,16 +9961,23 @@ } if (PyUnicode_READY(item) == -1) goto onError; - sz += PyUnicode_GET_LENGTH(item); + itemlen = PyUnicode_GET_LENGTH(item); item_maxchar = PyUnicode_MAX_CHAR_VALUE(item); maxchar = Py_MAX(maxchar, item_maxchar); - if (i != 0) - sz += seplen; - if (sz < old_sz || sz > PY_SSIZE_T_MAX) { + if (sz > PY_SSIZE_T_MAX - itemlen) { PyErr_SetString(PyExc_OverflowError, "join() result is too long for a Python string"); goto onError; } + sz += itemlen; + if (i != 0) { + if (sz > PY_SSIZE_T_MAX - seplen) { + PyErr_SetString(PyExc_OverflowError, + "join() result is too long for a Python string"); + goto onError; + } + sz += seplen; + } if (use_memcpy && last_obj != NULL) { if (PyUnicode_KIND(last_obj) != PyUnicode_KIND(item)) use_memcpy = 0; @@ -10608,7 +10615,7 @@ u = unicode_empty; goto done; } - if (new_size > (PY_SSIZE_T_MAX >> (rkind-1))) { + if (new_size > (PY_SSIZE_T_MAX / rkind) { PyErr_SetString(PyExc_OverflowError, "replace string is too long"); goto error;