Bug report

Bug description:

On 32-bit builds, int << n crashes for shift counts just below sys.maxsize * sys.int_info.bits_per_digit. long_lshift_int64() only checks that the word shift fits in Py_ssize_t, so oldsize + wordshift in long_lshift1() can wrap to a negative size, which long_alloc() accepts, and the zero-fill loop then writes far past the allocated block.

import sys
n = sys.maxsize * sys.int_info.bits_per_digit
(1 << 40) << n   # segfaults on 32-bit; expected OverflowError

On 64-bit builds the sum cannot wrap and OverflowError is raised as expected. This is a regression in 3.14 from GH-121486 (gh-121485) and GH-123724 (gh-123497), which removed the clipping of the word shift that 3.13 did in divmod_shift(); 3.13 is not affected.

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux

Linked PRs

• gh-160162: Fix crash in int left shift with huge count on 32-bit #160163
• [3.15] gh-160162: Fix crash in int left shift with huge count on 32-bit (GH-160163) #160169
• [3.14] gh-160162: Fix crash in int left shift with huge count on 32-bit (GH-160163) #160170