This commit is contained in:
Benjamin Peterson 2015-02-01 21:35:34 -05:00
commit c468b537cd
3 changed files with 32 additions and 2 deletions

View file

@ -2017,8 +2017,17 @@ product_new(PyTypeObject *type, PyObject *args, PyObject *kwds)
}
}
assert(PyTuple_Check(args));
nargs = (repeat == 0) ? 0 : PyTuple_GET_SIZE(args);
assert(PyTuple_CheckExact(args));
if (repeat == 0) {
nargs = 0;
} else {
nargs = PyTuple_GET_SIZE(args);
if (repeat > PY_SSIZE_T_MAX/sizeof(Py_ssize_t) ||
nargs > PY_SSIZE_T_MAX/(repeat * sizeof(Py_ssize_t))) {
PyErr_SetString(PyExc_OverflowError, "repeat argument too large");
return NULL;
}
}
npools = nargs * repeat;
indices = PyMem_Malloc(npools * sizeof(Py_ssize_t));
@ -3049,6 +3058,11 @@ permutations_new(PyTypeObject *type, PyObject *args, PyObject *kwds)
goto error;
}
if (n > PY_SSIZE_T_MAX/sizeof(Py_ssize_t) ||
r > PY_SSIZE_T_MAX/sizeof(Py_ssize_t)) {
PyErr_SetString(PyExc_OverflowError, "parameters too large");
goto error;
}
indices = PyMem_Malloc(n * sizeof(Py_ssize_t));
cycles = PyMem_Malloc(r * sizeof(Py_ssize_t));
if (indices == NULL || cycles == NULL) {