Possible overflow in typeobject.c:tail_contains #126862
Description
Bug report
Bug description:
whence+1 could lead to overflow for large value of whence. I think changing type from int to Py_ssize_t could fix the problem (remain is input parameter):
static int
pmerge(PyObject *acc, PyObject **to_merge, Py_ssize_t to_merge_size)
{
...
remain = PyMem_New(Py_ssize_t, to_merge_size);CPython versions tested on:
3.11
Operating systems tested on:
Linux
Linked PRs
- gh-126862: Use
Py_ssize_tinstead ofintwhen processing the number of super-classes #127523 - [3.13] gh-126862: Use
Py_ssize_tinstead ofintwhen processing the number of super-classes (GH-127523) #128699 - [3.12] gh-126862: Use
Py_ssize_tinstead ofintwhen processing the number of super-classes (GH-127523) #128700