New submission from Stephan Hohe <sth....@tejp.de>:
The array module's `array.remove(x)` iterates over the array, searching for `x`. If the array contains >=2G elements this can overflow the `int` loop variable. `array__array_reconstructor_impl()` also contains loops with `int` variables that likely have the similar problems. Changing the loop variables to `Py_ssize_t` fixes the problem. For details see the PR. ---------- components: Extension Modules messages: 337889 nosy: sth priority: normal severity: normal status: open title: Integer overflow in array.array.remove() type: crash versions: Python 2.7, Python 3.4, Python 3.5, Python 3.6, Python 3.7, Python 3.8 _______________________________________ Python tracker <rep...@bugs.python.org> <https://bugs.python.org/issue36285> _______________________________________ _______________________________________________ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
