From c60f77d5ab5c68f1fdaf0c734b77629418c7f903 Mon Sep 17 00:00:00 2001
From: Scott Shawcroft <scott@tannewt.org>
Date: Mon, 4 Feb 2019 15:33:36 -0800
Subject: Check sequence multiply for length overflow

Fixes #1279
---
 py/objstr.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

(limited to 'py/objstr.c')

diff --git a/py/objstr.c b/py/objstr.c
index 9b6cb0cf4..7236d9772 100644
--- a/py/objstr.c
+++ b/py/objstr.c
@@ -332,8 +332,9 @@ mp_obj_t mp_obj_str_binary_op(mp_binary_op_t op, mp_obj_t lhs_in, mp_obj_t rhs_i
                 return mp_const_empty_bytes;
             }
         }
+        size_t new_len = mp_seq_multiply_len(lhs_len, n);
         vstr_t vstr;
-        vstr_init_len(&vstr, lhs_len * n);
+        vstr_init_len(&vstr, new_len);
         mp_seq_multiply(lhs_data, sizeof(*lhs_data), lhs_len, n, vstr.buf);
         return mp_obj_new_str_from_vstr(lhs_type, &vstr);
     }
-- 
cgit v1.2.3