--- Python-2.5/Objects/listobject.c 2006-08-12 10:03:09.000000000 -0700 +++ mypython-2.5/Objects/listobject.c 2007-04-20 15:14:47.347919264 -0700 @@ -479,19 +479,19 @@ list_concat(PyListObject *a, PyObject *b static PyObject * list_repeat(PyListObject *a, Py_ssize_t n) { - Py_ssize_t i, j; - Py_ssize_t size; + Py_ssize_t i, j, d; PyListObject *np; PyObject **p, **items; PyObject *elem; - if (n < 0) - n = 0; - size = a->ob_size * n; - if (size == 0) + + if (n <= 0) return PyList_New(0); - if (n && size/n != a->ob_size) - return PyErr_NoMemory(); - np = (PyListObject *) PyList_New(size); + + d = PY_SSIZE_T_MAX / a->ob_size; + if (n > d) + return PyErr_NoMemory(); + + np = (PyListObject *) PyList_New(a->ob_size * n); if (np == NULL) return NULL; @@ -657,7 +657,7 @@ static PyObject * list_inplace_repeat(PyListObject *self, Py_ssize_t n) { PyObject **items; - Py_ssize_t size, i, j, p; + Py_ssize_t size, i, j, p, d; size = PyList_GET_SIZE(self); @@ -672,6 +672,10 @@ list_inplace_repeat(PyListObject *self, return (PyObject *)self; } + d = PY_SSIZE_T_MAX / size; + if (n > d) + return PyErr_NoMemory(); + if (list_resize(self, size*n) == -1) return NULL;