[2.7] bpo-36504: Fix signed integer overflow in _ctypes.c's PyCArrayType_new(). (GH-12660)

Lib/ctypes/test/test_arrays.py

@@ -134,6 +134,12 @@ class my_int(c_int):
  t2 = my_int * 1
  self.assertIs(t1, t2)
 
+ def test_bpo36504_signed_int_overflow(self):
+ # The overflow check in PyCArrayType_new() could cause signed integer
+ # overflow.
+ with self.assertRaises(OverflowError):
+ c_char * sys.maxsize * 2
+
  @unittest.skipUnless(sys.maxsize > 2**32, 'requires 64bit platform')
  @precisionbigmemtest(size=_2G, memuse=1, dry_run=False)
  def test_large_array(self, size):

Misc/NEWS.d/next/Core and Builtins/2019-04-02-04-10-32.bpo-36504.k_V8Bm.rst

@@ -0,0 +1 @@
+Fix signed integer overflow in _ctypes.c's ``PyCArrayType_new()``.

Modules/_ctypes/_ctypes.c

@@ -1534,7 +1534,7 @@ PyCArrayType_new(PyTypeObject *type, PyObject *args, PyObject *kwds)
  }
 
  itemsize = itemdict->size;
- if (length * itemsize < 0) {
+ if (length > PY_SSIZE_T_MAX / itemsize) {
  PyErr_SetString(PyExc_OverflowError,
  "array too large");
  Py_DECREF(stgdict);