Issue #27473: Fixed possible integer overflow in bytes and bytearray

concatenations.  Patch by Xiang Zhang.

1 files changed, 2 insertions, 4 deletions

diff --git a/Objects/bytesobject.c b/Objects/bytesobject.c
index 1ef21cc796..5f7786726e 100644
--- a/Objects/bytesobject.c
+++ b/Objects/bytesobject.c
@@ -1388,7 +1388,6 @@ bytes_length(PyBytesObject *a)
 static PyObject *
 bytes_concat(PyObject *a, PyObject *b)
 {
-    Py_ssize_t size;
     Py_buffer va, vb;
     PyObject *result = NULL;
 
@@ -1413,13 +1412,12 @@ bytes_concat(PyObject *a, PyObject *b)
         goto done;
     }
 
-    size = va.len + vb.len;
-    if (size < 0) {
+    if (va.len > PY_SSIZE_T_MAX - vb.len) {
         PyErr_NoMemory();
         goto done;
     }
 
-    result = PyBytes_FromStringAndSize(NULL, size);
+    result = PyBytes_FromStringAndSize(NULL, va.len + vb.len);
     if (result != NULL) {
         memcpy(PyBytes_AS_STRING(result), va.buf, va.len);
         memcpy(PyBytes_AS_STRING(result) + va.len, vb.buf, vb.len);