From 8a85c8c91b024f75889846a7fcd948174795cedf Mon Sep 17 00:00:00 2001
From: Sergey B Kirpichev <skirpichev@gmail.com>
Date: Thu, 3 Sep 2026 08:11:46 +0300
Subject: [PATCH] gh-156865: correctly handle overflows in memoryview

---
 Lib/test/test_memoryview.py                     | 17 +++++++++++++++++
 ...26-09-04-05-25-35.gh-issue-156865.7c5SBs.rst |  3 +++
 Objects/memoryobject.c                          | 13 +++++++++----
 3 files changed, 29 insertions(+), 4 deletions(-)
 create mode 100644 Misc/NEWS.d/next/Core_and_Builtins/2026-09-04-05-25-35.gh-issue-156865.7c5SBs.rst

diff --git a/Lib/test/test_memoryview.py b/Lib/test/test_memoryview.py
index 3cb8a104faee5e6..549fa02ce94df6b 100644
--- a/Lib/test/test_memoryview.py
+++ b/Lib/test/test_memoryview.py
@@ -931,6 +931,23 @@ def test_picklebuffer_reference_loop(self):
         gc.collect()
         self.assertIsNone(wr())
 
+    def test_overflows_in_floats(self):
+        array = import_helper.import_module("array")
+        half_data = array.array('e', [0.0])
+        float_data = array.array('f', [0.0])
+        complex_data = array.array('Zf', [0.0])
+        half_view = memoryview(half_data)
+        float_view = memoryview(float_data)
+        complex_view = memoryview(complex_data)
+        with self.assertRaises(ValueError):
+            half_view[0] = 123456.0
+        with self.assertRaises(ValueError):
+            float_view[0] = 1e300
+        with self.assertRaises(ValueError):
+            complex_view[0] = 1e300
+        with self.assertRaises(ValueError):
+            complex_view[0] = 1e300j
+
 
 @threading_helper.requires_working_threading()
 @support.requires_resource("cpu")
diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-09-04-05-25-35.gh-issue-156865.7c5SBs.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-09-04-05-25-35.gh-issue-156865.7c5SBs.rst
new file mode 100644
index 000000000000000..08df8d01465cda8
--- /dev/null
+++ b/Misc/NEWS.d/next/Core_and_Builtins/2026-09-04-05-25-35.gh-issue-156865.7c5SBs.rst
@@ -0,0 +1,3 @@
+Raise :exc:`ValueError`'s for overflows, while trying to change
+:class:`memoryview` elements with ``'f'`` and ``'Zf'`` format codes.  Patch
+by Sergey B Kirpichev.
diff --git a/Objects/memoryobject.c b/Objects/memoryobject.c
index 0bcd0b6596be776..cb20300043fd6e7 100644
--- a/Objects/memoryobject.c
+++ b/Objects/memoryobject.c
@@ -2037,7 +2037,9 @@ pack_single(PyMemoryViewObject *self, char *ptr, PyObject *item, const char *fmt
             goto err_occurred;
         CHECK_RELEASED_INT_AGAIN(self);
         if (fmt[0] == 'f') {
-            PACK_SINGLE(ptr, d, float);
+            if (PyFloat_Pack4(d, ptr, endian) < 0) {
+                goto err_occurred;
+            }
         }
         else if (fmt[0] == 'd') {
             PACK_SINGLE(ptr, d, double);
@@ -2064,9 +2066,12 @@ pack_single(PyMemoryViewObject *self, char *ptr, PyObject *item, const char *fmt
                 memcpy(ptr, &x, sizeof(x));
             }
             else {
-                float x[2] = {(float)c.real, (float)c.imag};
-
-                memcpy(ptr, &x, sizeof(x));
+                if (PyFloat_Pack4(c.real, ptr, endian) < 0) {
+                    goto err_occurred;
+                }
+                if (PyFloat_Pack4(c.imag, ptr + sizeof(float), endian) < 0) {
+                    goto err_occurred;
+                }
             }
             break;