gh-151847: Avoid undefined behaviour negating PY_SSIZE_T_MIN width in str/bytes formatting

Lib/test/test_format.py

@@ -318,6 +318,8 @@ def test_common_format(self):
                         "format argument 1: too big for width")
         test_exc_common('%*r', (-2**1000, 1), OverflowError,
                         "format argument 1: too big for width")
+        test_exc_common('%*r', (-maxsize - 1, 1), OverflowError,
+                        "format argument 1: too big for width")
         test_exc_common('%.*r', (2**1000, 1), OverflowError,
                         "format argument 1: too big for precision")
         test_exc_common('%.*r', (-2**1000, 1), OverflowError,

Misc/NEWS.d/next/Core_and_Builtins/2026-06-21-23-23-24.gh-issue-151847.5uNKTL.rst

@@ -0,0 +1,3 @@
+When formatting a ``str`` or ``bytes`` with ``%``, passing ``-sys.maxsize -
+1`` as the width previously negated it, this is undefined behaviour in C. It
+now raises :exc:`OverflowError`.

Objects/bytesobject.c

@@ -803,6 +803,11 @@ _PyBytes_FormatEx(const char *format, Py_ssize_t format_len,
                 }
                 if (width < 0) {
                     flags |= F_LJUST;
+                    if (width < -PY_SSIZE_T_MAX) {
+                        FORMAT_ERROR(PyExc_OverflowError,
+                                     "too big for width%s", "");
+                        goto error;
+                    }
                     width = -width;
                 }
                 if (--fmtcnt >= 0)

Objects/unicode_format.c

@@ -560,6 +560,10 @@ unicode_format_arg_parse(struct unicode_formatter_t *ctx,
         }
         if (arg->width < 0) {
             arg->flags |= F_LJUST;
+            if (arg->width < -PY_SSIZE_T_MAX) {
+                FORMAT_ERROR(PyExc_OverflowError, "too big for width%s", "");
+                return -1;
+            }
             arg->width = -arg->width;
         }
         if (--ctx->fmtcnt >= 0) {