https://github.com/python/cpython/commit/c3608845b678729245ef03deb78c47cdabcddf5f
commit: c3608845b678729245ef03deb78c47cdabcddf5f
branch: main
author: Gregory P. Smith <[email protected]>
committer: gpshead <[email protected]>
date: 2026-10-20T16:00:14-07:00
summary:
gh-159739: Fix crash in _PyTuple_Resize() with an invalid size (GH-159804)
_PyTuple_Resize() did not validate newsize for non-empty tuples.
Raise SystemError for a negative size and MemoryError for a too-large size,
like PyTuple_New() already does for the empty-tuple path.
files:
A Misc/NEWS.d/next/C_API/2026-10-19-21-05-12.gh-issue-159739.Rk3fTq.rst
M Lib/test/test_capi/test_tuple.py
M Objects/tupleobject.c
diff --git a/Lib/test/test_capi/test_tuple.py b/Lib/test/test_capi/test_tuple.py
index d497ba30b001ac..fe5d694ea7d831 100644
--- a/Lib/test/test_capi/test_tuple.py
+++ b/Lib/test/test_capi/test_tuple.py
@@ -327,6 +327,10 @@ def test__tuple_resize(self):
self.assertRaises(MemoryError, resize, a, PY_SSIZE_T_MAX)
self.assertRaises(SystemError, resize, a, -1)
self.assertRaises(SystemError, resize, a, PY_SSIZE_T_MIN)
+ a = ([1], [2], [3])
+ self.assertRaises(MemoryError, resize, a, PY_SSIZE_T_MAX)
+ self.assertRaises(SystemError, resize, a, -1)
+ self.assertRaises(SystemError, resize, a, PY_SSIZE_T_MIN)
# refcount > 1
a = (1, 2, 3)
self.assertRaises(SystemError, resize, a, 3, False)
diff --git
a/Misc/NEWS.d/next/C_API/2026-10-19-21-05-12.gh-issue-159739.Rk3fTq.rst
b/Misc/NEWS.d/next/C_API/2026-10-19-21-05-12.gh-issue-159739.Rk3fTq.rst
new file mode 100644
index 00000000000000..2d510c63ac07a8
--- /dev/null
+++ b/Misc/NEWS.d/next/C_API/2026-10-19-21-05-12.gh-issue-159739.Rk3fTq.rst
@@ -0,0 +1,3 @@
+Fix a crash in :c:func:`_PyTuple_Resize` when resizing a non-empty tuple to a
+negative or too large size. It now raises :exc:`SystemError` or
+:exc:`MemoryError` respectively.
diff --git a/Objects/tupleobject.c b/Objects/tupleobject.c
index d7523e31779971..1ca28379f328cf 100644
--- a/Objects/tupleobject.c
+++ b/Objects/tupleobject.c
@@ -1021,7 +1021,7 @@ _PyTuple_Resize(PyObject **pv, Py_ssize_t newsize)
Py_ssize_t oldsize;
v = (PyTupleObject *) *pv;
- if (v == NULL || !Py_IS_TYPE(v, &PyTuple_Type) ||
+ if (v == NULL || !Py_IS_TYPE(v, &PyTuple_Type) || newsize < 0 ||
(Py_SIZE(v) != 0 && !_PyObject_IsUniquelyReferenced(*pv))) {
*pv = 0;
Py_XDECREF(v);
@@ -1048,6 +1048,14 @@ _PyTuple_Resize(PyObject **pv, Py_ssize_t newsize)
*pv = PyTuple_New(newsize);
return *pv == NULL ? -1 : 0;
}
+ /* Check for overflow */
+ if ((size_t)newsize > ((size_t)PY_SSIZE_T_MAX - (sizeof(PyTupleObject) -
+ sizeof(PyObject *))) / sizeof(PyObject *)) {
+ *pv = NULL;
+ Py_DECREF(v);
+ PyErr_NoMemory();
+ return -1;
+ }
if (_PyObject_GC_IS_TRACKED(v)) {
_PyObject_GC_UNTRACK(v);
_______________________________________________
Python-checkins mailing list -- [email protected]
To unsubscribe send an email to [email protected]
https://mail.python.org/mailman3//lists/python-checkins.python.org
Member address: [email protected]
