homepage

When PY_SSIZE_T isn't defined and a format such as "s#" receives an object whose length fits in a Py_ssize_t but not in an int, the buffer length is silently truncated:
>>> s = 'x' * (4 * 1024**3 + 100)
>>> t = zlib.compress(s, 1)
>>> len(t)
12
>>> len(zlib.decompress(t))
100
(from issue8650)

getarg.patch fixes STORE_SIZE macro used in convertsimple(). If the input size is bigger than INT_MAX, it raises an OverflowError("size does not fit in an int") and calls converterr() which expected="".
The value of expected is useless because converterr() is only used to notice that an error occured. I think that return msgbuf instead of calling converterr() would be enough, but I don't know this code very well and so i copied the code used to raise an OverflowError for the 'b' format.

Another test (only requires ~2 GB of memory, not 4 GB or more) for the patch:
import _elementtree
def test():
 parser=_elementtree.XMLParser()
 text='s' * (2**31 + 10)
 try:
 parser.feed(text)
 except OverflowError as err:
 print("ok: %s" % err)
 return
 except:
 pass
 print("error: OverflowError not raised")
test()

Could you add a proper unit test?

Fixed by r87728.
Wait for the buildbots before backporting to other versions.

I removed Antoine's message because it was related to issue #8650.

New changeset d9633064458c by Victor Stinner in branch '3.1':
Issue #8651: PyArg_Parse*() functions raise an OverflowError if the file
http://hg.python.org/cpython/rev/d9633064458c 

Ok, I backported the fix to 3.1.
Reopen the issue if you would like a port to 2.7 (I am too lazy to do it).

New changeset 509f1c15a1e1 by Victor Stinner in branch '2.7':
Issue #8651: Fix "z#" format of PyArg_Parse*() function: the size was not
http://hg.python.org/cpython/rev/509f1c15a1e1 

New changeset a0681e7a6ded by Victor Stinner in branch '2.7':
Issue #8651: PyArg_Parse*() functions raise an OverflowError if the file
http://hg.python.org/cpython/rev/a0681e7a6ded 

> Reopen the issue if you would like a port to 2.7
> (I am too lazy to do it)
I backported the fix to help issue #11277. While backporting the fix, I found another bug fixed by 509f1c15a1e1.