Avoid undefined behaviour negating PY_SSIZE_T_MIN width in str/bytes formatting

Author: aisk

Lib/test/test_format.py

@@ -318,6 +318,8 @@ def test_common_format(self):
                         "format argument 1: too big for width")
         test_exc_common('%*r', (-2**1000, 1), OverflowError,
                         "format argument 1: too big for width")
+        test_exc_common('%*r', (-maxsize - 1, 1), OverflowError,
+                        "format argument 1: too big for width")
         test_exc_common('%.*r', (2**1000, 1), OverflowError,
                         "format argument 1: too big for precision")
         test_exc_common('%.*r', (-2**1000, 1), OverflowError,

Objects/bytesobject.c

@@ -803,6 +803,11 @@ _PyBytes_FormatEx(const char *format, Py_ssize_t format_len,
                 }
                 if (width < 0) {
                     flags |= F_LJUST;
+                    if (width < -PY_SSIZE_T_MAX) {
+                        FORMAT_ERROR(PyExc_OverflowError,
+                                     "too big for width%s", "");
+                        goto error;
+                    }
                     width = -width;
                 }
                 if (--fmtcnt >= 0)

Objects/unicode_format.c

@@ -560,6 +560,10 @@ unicode_format_arg_parse(struct unicode_formatter_t *ctx,
         }
         if (arg->width < 0) {
             arg->flags |= F_LJUST;
+            if (arg->width < -PY_SSIZE_T_MAX) {
+                FORMAT_ERROR(PyExc_OverflowError, "too big for width%s", "");
+                return -1;
+            }
             arg->width = -arg->width;
         }
         if (--ctx->fmtcnt >= 0) {