diff --git a/Lib/test/test_capi/test_tuple.py b/Lib/test/test_capi/test_tuple.py index 3683c008dbcaaf..3b5f0336d696bc 100644 --- a/Lib/test/test_capi/test_tuple.py +++ b/Lib/test/test_capi/test_tuple.py @@ -261,6 +261,10 @@ def test__tuple_resize(self): self.assertRaises(MemoryError, resize, a, PY_SSIZE_T_MAX) self.assertRaises(SystemError, resize, a, -1) self.assertRaises(SystemError, resize, a, PY_SSIZE_T_MIN) + a = ([1], [2], [3]) + self.assertRaises(MemoryError, resize, a, PY_SSIZE_T_MAX) + self.assertRaises(SystemError, resize, a, -1) + self.assertRaises(SystemError, resize, a, PY_SSIZE_T_MIN) # refcount > 1 a = (1, 2, 3) self.assertRaises(SystemError, resize, a, 3, False) diff --git a/Misc/NEWS.d/next/C_API/2026-10-19-21-05-12.gh-issue-159739.Rk3fTq.rst b/Misc/NEWS.d/next/C_API/2026-10-19-21-05-12.gh-issue-159739.Rk3fTq.rst new file mode 100644 index 00000000000000..2d510c63ac07a8 --- /dev/null +++ b/Misc/NEWS.d/next/C_API/2026-10-19-21-05-12.gh-issue-159739.Rk3fTq.rst @@ -0,0 +1,3 @@ +Fix a crash in :c:func:`_PyTuple_Resize` when resizing a non-empty tuple to a +negative or too large size. It now raises :exc:`SystemError` or +:exc:`MemoryError` respectively. diff --git a/Objects/tupleobject.c b/Objects/tupleobject.c index 9ed8fc3e964386..6e9b36864a12b4 100644 --- a/Objects/tupleobject.c +++ b/Objects/tupleobject.c @@ -961,7 +961,7 @@ _PyTuple_Resize(PyObject **pv, Py_ssize_t newsize) Py_ssize_t oldsize; v = (PyTupleObject *) *pv; - if (v == NULL || !Py_IS_TYPE(v, &PyTuple_Type) || + if (v == NULL || !Py_IS_TYPE(v, &PyTuple_Type) || newsize < 0 || (Py_SIZE(v) != 0 && !_PyObject_IsUniquelyReferenced(*pv))) { *pv = 0; Py_XDECREF(v); @@ -988,6 +988,14 @@ _PyTuple_Resize(PyObject **pv, Py_ssize_t newsize) *pv = PyTuple_New(newsize); return *pv == NULL ? -1 : 0; } + /* Check for overflow */ + if ((size_t)newsize > ((size_t)PY_SSIZE_T_MAX - (sizeof(PyTupleObject) - + sizeof(PyObject *))) / sizeof(PyObject *)) { + *pv = NULL; + Py_DECREF(v); + PyErr_NoMemory(); + return -1; + } if (_PyObject_GC_IS_TRACKED(v)) { _PyObject_GC_UNTRACK(v);