@@ -327,6 +327,10 @@ def test__tuple_resize(self):
         self.assertRaises(MemoryError, resize, a, PY_SSIZE_T_MAX)
         self.assertRaises(SystemError, resize, a, -1)
         self.assertRaises(SystemError, resize, a, PY_SSIZE_T_MIN)
+        a = ([1], [2], [3])
+        self.assertRaises(MemoryError, resize, a, PY_SSIZE_T_MAX)
+        self.assertRaises(SystemError, resize, a, -1)
+        self.assertRaises(SystemError, resize, a, PY_SSIZE_T_MIN)
         # refcount > 1
         a = (1, 2, 3)
         self.assertRaises(SystemError, resize, a, 3, False)
 
@@ -0,0 +1,3 @@
+Fix a crash in :c:func:`_PyTuple_Resize` when resizing a non-empty tuple to a
+negative or too large size. It now raises :exc:`SystemError` or
+:exc:`MemoryError` respectively.
@@ -1021,7 +1021,7 @@ _PyTuple_Resize(PyObject **pv, Py_ssize_t newsize)
     Py_ssize_t oldsize;
 
     v = (PyTupleObject *) *pv;
-    if (v == NULL || !Py_IS_TYPE(v, &PyTuple_Type) ||
+    if (v == NULL || !Py_IS_TYPE(v, &PyTuple_Type) || newsize < 0 ||
         (Py_SIZE(v) != 0 && !_PyObject_IsUniquelyReferenced(*pv))) {
         *pv = 0;
         Py_XDECREF(v);
@@ -1048,6 +1048,14 @@ _PyTuple_Resize(PyObject **pv, Py_ssize_t newsize)
         *pv = PyTuple_New(newsize);
         return *pv == NULL ? -1 : 0;
     }
+    /* Check for overflow */
+    if ((size_t)newsize > ((size_t)PY_SSIZE_T_MAX - (sizeof(PyTupleObject) -
+                sizeof(PyObject *))) / sizeof(PyObject *)) {
+        *pv = NULL;
+        Py_DECREF(v);
+        PyErr_NoMemory();
+        return -1;
+    }
 
     if (_PyObject_GC_IS_TRACKED(v)) {
         _PyObject_GC_UNTRACK(v);
Original file line number	Diff line number	Diff line change
@@ -0,0 +1,3 @@
	1	+ Fix a crash in :c:func:`_PyTuple_Resize` when resizing a non-empty tuple to a
	2	+ negative or too large size. It now raises :exc:`SystemError` or
	3	+ :exc:`MemoryError` respectively.