Bug report

Bug description:

whence+1 could lead to overflow for large value of whence. I think changing type from int to Py_ssize_t could fix the problem (remain is input parameter):

static int
pmerge(PyObject *acc, PyObject **to_merge, Py_ssize_t to_merge_size)
{
...
    remain = PyMem_New(Py_ssize_t, to_merge_size);

CPython versions tested on:

3.11

Operating systems tested on:

Linux

Linked PRs

• gh-126862: Use Py_ssize_t instead of int when processing the number of super-classes  #127523
• [3.13] gh-126862: Use Py_ssize_t instead of int when processing the number of super-classes (GH-127523) #128699
• [3.12] gh-126862: Use Py_ssize_t instead of int when processing the number of super-classes (GH-127523) #128700