gh-158446: Also bound large negative precisions; broaden NEWS wording

Make the PyOS_double_to_string() precision check symmetric so that C
callers passing a huge negative precision cannot reach the remaining
precision arithmetic either.  Reword the NEWS entry: the limit applies to
float and complex formatting regardless of presentation type or value.

Author: gpshead

Misc/NEWS.d/next/Security/2026-09-29-16-32-46.gh-issue-158446.dToaPr.rst

@@ -1,4 +1,5 @@
-Fix a crash or incorrect output when formatting a :class:`float` using the
-``'f'``, ``'e'`` or ``'g'`` presentation types with a precision close to the
-platform's ``INT_MAX``.  Such precisions now raise :exc:`ValueError`, as
-precisions above ``INT_MAX`` already did.
+Fix a crash or incorrect output that could occur when formatting a
+:class:`float` or :class:`complex` with a precision close to the platform's
+``INT_MAX``.  :c:func:`PyOS_double_to_string` now raises :exc:`ValueError` for
+any precision of that magnitude, regardless of presentation type or value, as
+the format string parsers already did for precisions above ``INT_MAX``.

Python/pystrtod.c

@@ -401,11 +401,12 @@ _Py_string_to_number_with_underscores(
     return NULL;
 }
 
-/* Largest precision accepted by PyOS_double_to_string().  The output buffer
-   sizes computed below and within _Py_dg_dtoa() use int and Py_ssize_t
-   arithmetic on roughly precision + (digits before the point, at most
-   DBL_MAX_10_EXP + 1 == 309) + a few bytes of sign, point and exponent.
-   Staying this far below INT_MAX keeps all of those sums in range. */
+/* Largest precision magnitude accepted by PyOS_double_to_string().  The
+   output buffer sizes computed below and within _Py_dg_dtoa() use int and
+   Py_ssize_t arithmetic on roughly precision + (digits before the point, at
+   most DBL_MAX_10_EXP + 1 == 309) + a few bytes of sign, point and exponent.
+   Staying this far inside the int range keeps all of those sums in range.
+   (Only C callers can pass a negative precision.) */
 #define DOUBLE_TO_STRING_PRECISION_MAX (INT_MAX - 1024)
 
 #if _PY_SHORT_FLOAT_REPR == 0
@@ -773,7 +774,8 @@ char * PyOS_double_to_string(double val,
     int t, exp;
     int upper = 0;
 
-    if (precision > DOUBLE_TO_STRING_PRECISION_MAX) {
+    if (precision > DOUBLE_TO_STRING_PRECISION_MAX
+        || precision < -DOUBLE_TO_STRING_PRECISION_MAX) {
         PyErr_SetString(PyExc_ValueError, "precision too big");
         return NULL;
     }
@@ -1239,7 +1241,8 @@ char * PyOS_double_to_string(double val,
     const char * const *float_strings = lc_float_strings;
     int mode;
 
-    if (precision > DOUBLE_TO_STRING_PRECISION_MAX) {
+    if (precision > DOUBLE_TO_STRING_PRECISION_MAX
+        || precision < -DOUBLE_TO_STRING_PRECISION_MAX) {
         PyErr_SetString(PyExc_ValueError, "precision too big");
         return NULL;
     }