[New-bugs-announce] [issue36285] Integer overflow in array.array.remove()

[Stephan Hohe]

New submission from Stephan Hohe <sth.dev at tejp.de>:

The array module's `array.remove(x)` iterates over the array, searching for `x`. If the array contains >=2G elements this can overflow the `int` loop variable.

`array__array_reconstructor_impl()` also contains loops with `int` variables that likely have the similar problems.

Changing the loop variables to `Py_ssize_t` fixes the problem. For details see the PR.

----------
components: Extension Modules
messages: 337889
nosy: sth
priority: normal
severity: normal
status: open
title: Integer overflow in array.array.remove()
type: crash
versions: Python 2.7, Python 3.4, Python 3.5, Python 3.6, Python 3.7, Python 3.8

_______________________________________
Python tracker <report at bugs.python.org>
<https://bugs.python.org/issue36285>
_______________________________________