gh-158446: Reject float format precision near INT_MAX

PyOS_double_to_string() now raises ValueError("precision too big") for
precisions above INT_MAX - 1024, matching what the format parsers already
do above INT_MAX.  Buffer size computations in pystrtod.c and dtoa.c add a
few hundred to the precision using int / Py_ssize_t arithmetic and could
wrap for such values, leading to a crash or incorrect output.

Also harden _Py_dg_dtoa() and rv_alloc() so their size arithmetic stays in
range for any C caller.

Author: gpshead

Lib/test/test_format.py

@@ -639,6 +639,28 @@ def test_precision_c_limits(self):
         with self.assertRaises(ValueError) as cm:
             format(c, ".%sf" % (INT_MAX + 1))
 
+    @support.cpython_only
+    def test_precision_near_int_max(self):
+        # gh-158446: Precisions just below INT_MAX are rejected before any output
+        # buffer size is computed from them.
+        _testcapi = import_module("_testcapi")
+        INT_MAX = _testcapi.INT_MAX
+
+        f = 1e300
+        c = complex(f)
+        for prec in (INT_MAX, INT_MAX - 1023):
+            for code in "feg":
+                spec = ".%d%s" % (prec, code)
+                with self.subTest(spec=spec):
+                    with self.assertRaises(ValueError):
+                        format(f, spec)
+                    with self.assertRaises(ValueError):
+                        format(c, spec)
+                    with self.assertRaises(ValueError):
+                        ("%" + spec) % f
+                    with self.assertRaises(ValueError):
+                        ("%" + spec).encode() % f
+
     def test_g_format_has_no_trailing_zeros(self):
         # regression test for bugs.python.org/issue40780
         self.assertEqual("%.3g" % 1505.0, "1.5e+03")

Misc/NEWS.d/next/Security/2026-09-29-16-32-46.gh-issue-158446.dToaPr.rst

@@ -0,0 +1,4 @@
+Fix a crash or incorrect output when formatting a :class:`float` using the
+``'f'``, ``'e'`` or ``'g'`` presentation types with a precision close to the
+platform's ``INT_MAX``.  Such precisions now raise :exc:`ValueError`, as
+precisions above ``INT_MAX`` already did.

Python/dtoa.c

@@ -2108,7 +2108,8 @@ _Py_dg_strtod(const char *s00, char **se)
 static char *
 rv_alloc(int i)
 {
-    int j, k, *r;
+    int k, *r;
+    size_t j;   /* size_t so that j <<= 1 cannot overflow for i near INT_MAX */
 
     j = sizeof(ULong);
     for(k = 0;
@@ -2372,6 +2373,14 @@ _Py_dg_dtoa(double dd, int mode, int ndigits,
         leftright = 0;
         _Py_FALLTHROUGH;
     case 5:
+        /* -330 < k < 330 for any finite nonzero double.  Clamp ndigits so
+           that ndigits + k + 1 stays within int range; no double has
+           anywhere near this many decimal digits so the digits returned
+           are unaffected. */
+        if (ndigits > INT_MAX - 1024)
+            ndigits = INT_MAX - 1024;
+        else if (ndigits < -(INT_MAX - 1024))
+            ndigits = -(INT_MAX - 1024);
         i = ndigits + k + 1;
         ilim = i;
         ilim1 = i - 1;

Python/pystrtod.c

@@ -401,6 +401,13 @@ _Py_string_to_number_with_underscores(
     return NULL;
 }
 
+/* Largest precision accepted by PyOS_double_to_string().  The output buffer
+   sizes computed below and within _Py_dg_dtoa() use int and Py_ssize_t
+   arithmetic on roughly precision + (digits before the point, at most
+   DBL_MAX_10_EXP + 1 == 309) + a few bytes of sign, point and exponent.
+   Staying this far below INT_MAX keeps all of those sums in range. */
+#define DOUBLE_TO_STRING_PRECISION_MAX (INT_MAX - 1024)
+
 #if _PY_SHORT_FLOAT_REPR == 0
 
 /* Given a string that may have a decimal point in the current
@@ -766,6 +773,11 @@ char * PyOS_double_to_string(double val,
     int t, exp;
     int upper = 0;
 
+    if (precision > DOUBLE_TO_STRING_PRECISION_MAX) {
+        PyErr_SetString(PyExc_ValueError, "precision too big");
+        return NULL;
+    }
+
     /* Validate format_code, and map upper and lower case */
     switch (format_code) {
     case 'e':          /* exponent */
@@ -1227,6 +1239,11 @@ char * PyOS_double_to_string(double val,
     const char * const *float_strings = lc_float_strings;
     int mode;
 
+    if (precision > DOUBLE_TO_STRING_PRECISION_MAX) {
+        PyErr_SetString(PyExc_ValueError, "precision too big");
+        return NULL;
+    }
+
     /* Validate format_code, and map upper and lower case. Compute the
        mode and make any adjustments as needed. */
     switch (format_code) {