gh-156865: Correctly handle float/complex overflows in memoryview (#156916)

Co-authored-by: Maurycy Pawłowski-Wieroński <maurycy@maurycy.com>

Author: skirpichev

Lib/test/test_memoryview.py

@@ -931,6 +931,24 @@ def test_picklebuffer_reference_loop(self):
         gc.collect()
         self.assertIsNone(wr())
 
+    def test_overflows_in_floats(self):
+        half_data = array.array('e', [0.0])
+        float_data = array.array('f', [0.0])
+        complex_data = array.array('Zf', [123+321j])
+        half_view = memoryview(half_data)
+        float_view = memoryview(float_data)
+        complex_view = memoryview(complex_data)
+        with self.assertRaises(ValueError):
+            half_view[0] = 123456.0
+        with self.assertRaises(ValueError):
+            float_view[0] = 1e300
+        with self.assertRaises(ValueError):
+            complex_view[0] = 1e300
+        self.assertEqual(complex_view[0], 123+321j)
+        with self.assertRaises(ValueError):
+            complex_view[0] = 1e300j
+        self.assertEqual(complex_view[0], 123+321j)
+
 
 @threading_helper.requires_working_threading()
 @support.requires_resource("cpu")

Misc/NEWS.d/next/Core_and_Builtins/2026-09-04-05-25-35.gh-issue-156865.7c5SBs.rst

@@ -0,0 +1,3 @@
+Raise :exc:`ValueError`'s for overflows, while trying to change
+:class:`memoryview` elements with ``'f'`` and ``'Zf'`` format codes.  Patch
+by Sergey B Kirpichev.

Objects/memoryobject.c

@@ -2037,7 +2037,9 @@ pack_single(PyMemoryViewObject *self, char *ptr, PyObject *item, const char *fmt
             goto err_occurred;
         CHECK_RELEASED_INT_AGAIN(self);
         if (fmt[0] == 'f') {
-            PACK_SINGLE(ptr, d, float);
+            if (PyFloat_Pack4(d, ptr, endian) < 0) {
+                goto err_occurred;
+            }
         }
         else if (fmt[0] == 'd') {
             PACK_SINGLE(ptr, d, double);
@@ -2064,9 +2066,15 @@ pack_single(PyMemoryViewObject *self, char *ptr, PyObject *item, const char *fmt
                 memcpy(ptr, &x, sizeof(x));
             }
             else {
-                float x[2] = {(float)c.real, (float)c.imag};
-
-                memcpy(ptr, &x, sizeof(x));
+                char tmp[8];
+
+                if (PyFloat_Pack4(c.real, tmp, endian) < 0) {
+                    goto err_occurred;
+                }
+                if (PyFloat_Pack4(c.imag, tmp + 4, endian) < 0) {
+                    goto err_occurred;
+                }
+                memcpy(ptr, tmp, 8);
             }
             break;