gh-158446: Address review nits

Note the dtoa.c deviations in its header list, cross-reference the shared
bound between dtoa.c and pystrtod.c, PEP 7 brace placement, and wrap a
long test comment.  No functional change.

Author: gpshead

Lib/test/test_format.py

@@ -641,8 +641,8 @@ def test_precision_c_limits(self):
 
     @support.cpython_only
     def test_precision_near_int_max(self):
-        # gh-158446: Precisions just below INT_MAX are rejected before any output
-        # buffer size is computed from them.
+        # gh-158446: Precisions just below INT_MAX are rejected before any
+        # output buffer size is computed from them.
         _testcapi = import_module("_testcapi")
         INT_MAX = _testcapi.INT_MAX
 

Python/dtoa.c

@@ -67,6 +67,10 @@
  *  8. A corner case where _Py_dg_dtoa didn't strip trailing zeros has been
  *     fixed. (bugs.python.org/issue40780)
  *
+ *  9. _Py_dg_dtoa clamps ndigits in modes 3 and 5 so that its buffer size
+ *     arithmetic cannot exceed the int range, and rv_alloc's size doubling
+ *     uses size_t. (gh-158446)
+ *
  ***************************************************************/
 
 /* Please send bug reports for the original dtoa.c code to David M. Gay (dmg
@@ -2376,7 +2380,8 @@ _Py_dg_dtoa(double dd, int mode, int ndigits,
         /* -330 < k < 330 for any finite nonzero double.  Clamp ndigits so
            that ndigits + k + 1 stays within int range; no double has
            anywhere near this many decimal digits so the digits returned
-           are unaffected. */
+           are unaffected (*decpt saturates in the no_digits case).  Same
+           bound as DOUBLE_TO_STRING_PRECISION_MAX in pystrtod.c. */
         if (ndigits > INT_MAX - 1024)
             ndigits = INT_MAX - 1024;
         else if (ndigits < -(INT_MAX - 1024))

Python/pystrtod.c

@@ -406,7 +406,8 @@ _Py_string_to_number_with_underscores(
    Py_ssize_t arithmetic on roughly precision + (digits before the point, at
    most DBL_MAX_10_EXP + 1 == 309) + a few bytes of sign, point and exponent.
    Staying this far inside the int range keeps all of those sums in range.
-   (Only C callers can pass a negative precision.) */
+   (Only C callers can pass a negative precision.)  _Py_dg_dtoa() applies
+   the same bound to its ndigits argument. */
 #define DOUBLE_TO_STRING_PRECISION_MAX (INT_MAX - 1024)
 
 #if _PY_SHORT_FLOAT_REPR == 0
@@ -775,7 +776,8 @@ char * PyOS_double_to_string(double val,
     int upper = 0;
 
     if (precision > DOUBLE_TO_STRING_PRECISION_MAX
-        || precision < -DOUBLE_TO_STRING_PRECISION_MAX) {
+        || precision < -DOUBLE_TO_STRING_PRECISION_MAX)
+    {
         PyErr_SetString(PyExc_ValueError, "precision too big");
         return NULL;
     }
@@ -1242,7 +1244,8 @@ char * PyOS_double_to_string(double val,
     int mode;
 
     if (precision > DOUBLE_TO_STRING_PRECISION_MAX
-        || precision < -DOUBLE_TO_STRING_PRECISION_MAX) {
+        || precision < -DOUBLE_TO_STRING_PRECISION_MAX)
+    {
         PyErr_SetString(PyExc_ValueError, "precision too big");
         return NULL;
     }