[3.15] gh-159739: Fix crash in _PyTuple_Resize() with an invalid size (GH-159804) (#159976)

gh-159739: Fix crash in _PyTuple_Resize() with an invalid size (GH-159804)

_PyTuple_Resize() did not validate newsize for non-empty tuples.

Raise SystemError for a negative size and MemoryError for a too-large size,
like PyTuple_New() already does for the empty-tuple path.
(cherry picked from commit c360884)

Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com>

Author: miss-islington

Lib/test/test_capi/test_tuple.py

@@ -327,6 +327,10 @@ def test__tuple_resize(self):
         self.assertRaises(MemoryError, resize, a, PY_SSIZE_T_MAX)
         self.assertRaises(SystemError, resize, a, -1)
         self.assertRaises(SystemError, resize, a, PY_SSIZE_T_MIN)
+        a = ([1], [2], [3])
+        self.assertRaises(MemoryError, resize, a, PY_SSIZE_T_MAX)
+        self.assertRaises(SystemError, resize, a, -1)
+        self.assertRaises(SystemError, resize, a, PY_SSIZE_T_MIN)
         # refcount > 1
         a = (1, 2, 3)
         self.assertRaises(SystemError, resize, a, 3, False)

Misc/NEWS.d/next/C_API/2026-10-19-21-05-12.gh-issue-159739.Rk3fTq.rst

@@ -0,0 +1,3 @@
+Fix a crash in :c:func:`_PyTuple_Resize` when resizing a non-empty tuple to a
+negative or too large size. It now raises :exc:`SystemError` or
+:exc:`MemoryError` respectively.

Objects/tupleobject.c

@@ -1041,7 +1041,7 @@ _PyTuple_Resize(PyObject **pv, Py_ssize_t newsize)
     Py_ssize_t oldsize;
 
     v = (PyTupleObject *) *pv;
-    if (v == NULL || !Py_IS_TYPE(v, &PyTuple_Type) ||
+    if (v == NULL || !Py_IS_TYPE(v, &PyTuple_Type) || newsize < 0 ||
         (Py_SIZE(v) != 0 && !_PyObject_IsUniquelyReferenced(*pv))) {
         *pv = 0;
         Py_XDECREF(v);
@@ -1068,6 +1068,14 @@ _PyTuple_Resize(PyObject **pv, Py_ssize_t newsize)
         *pv = PyTuple_New(newsize);
         return *pv == NULL ? -1 : 0;
     }
+    /* Check for overflow */
+    if ((size_t)newsize > ((size_t)PY_SSIZE_T_MAX - (sizeof(PyTupleObject) -
+                sizeof(PyObject *))) / sizeof(PyObject *)) {
+        *pv = NULL;
+        Py_DECREF(v);
+        PyErr_NoMemory();
+        return -1;
+    }
 
     if (_PyObject_GC_IS_TRACKED(v)) {
         _PyObject_GC_UNTRACK(v);