diff -r 3954f8f6be3d Objects/stringlib/transmogrify.h
--- a/Objects/stringlib/transmogrify.h	Mon Jan 09 11:52:10 2017 +0800
+++ b/Objects/stringlib/transmogrify.h	Mon Jan 09 13:35:19 2017 +0800
@@ -261,7 +261,7 @@
     assert(count > 0);
     if (to_len > (PY_SSIZE_T_MAX - self_len) / count) {
         PyErr_SetString(PyExc_OverflowError,
-                        "replace bytes are too long");
+                        "replace bytes is too long");
         return NULL;
     }
     result_len = count * to_len + self_len;
diff -r 3954f8f6be3d Objects/unicodeobject.c
--- a/Objects/unicodeobject.c	Mon Jan 09 11:52:10 2017 +0800
+++ b/Objects/unicodeobject.c	Mon Jan 09 13:35:19 2017 +0800
@@ -9950,7 +9950,7 @@
     use_memcpy = 1;
 #endif
     for (i = 0; i < seqlen; i++) {
-        const Py_ssize_t old_sz = sz;
+        size_t add_sz;
         item = items[i];
         if (!PyUnicode_Check(item)) {
             PyErr_Format(PyExc_TypeError,
@@ -9961,16 +9961,18 @@
         }
         if (PyUnicode_READY(item) == -1)
             goto onError;
-        sz += PyUnicode_GET_LENGTH(item);
+        add_sz = PyUnicode_GET_LENGTH(item);
         item_maxchar = PyUnicode_MAX_CHAR_VALUE(item);
         maxchar = Py_MAX(maxchar, item_maxchar);
-        if (i != 0)
-            sz += seplen;
-        if (sz < old_sz || sz > PY_SSIZE_T_MAX) {
+        if (i != 0) {
+            add_sz += seplen;
+        }
+        if (add_sz > (size_t)(PY_SSIZE_T_MAX - sz)) {
             PyErr_SetString(PyExc_OverflowError,
                             "join() result is too long for a Python string");
             goto onError;
         }
+        sz += add_sz;
         if (use_memcpy && last_obj != NULL) {
             if (PyUnicode_KIND(last_obj) != PyUnicode_KIND(item))
                 use_memcpy = 0;
@@ -10608,7 +10610,7 @@
             u = unicode_empty;
             goto done;
         }
-        if (new_size > (PY_SSIZE_T_MAX >> (rkind-1))) {
+        if (new_size > (PY_SSIZE_T_MAX / rkind)) {
             PyErr_SetString(PyExc_OverflowError,
                             "replace string is too long");
             goto error;