Read the frozen-code tuple length as a signed length

The '(' branches in read_marshal_str_vec() and read_marshal_const_tuple() took the length with read_u32() as usize, so a value with the top bit set read as four billion items rather than as out of range. read_len() is what every other length in this file goes through, and it reinterprets as i32. Both readers serve deserialize_code(), which reads only the frozen modules baked in at build time, so this changes no reachable behavior; marshal.loads() already went through read_len(). Assisted-by: Claude
RustPython · youknowone · Aug 16, 2026 · Aug 14, 2026 · Aug 14, 2026 · Aug 14, 2026
commit 7c40cb9d71598025f938ed70b518ff5c7a260548
diff --git a/crates/compiler-core/src/marshal.rs b/crates/compiler-core/src/marshal.rs
@@ -418,7 +418,7 @@ fn read_marshal_str_vec<R: Read, Bag: ConstantBag>(
     }
 
     let n = match type_byte {
-        b'(' => rdr.read_u32()? as usize,
+        b'(' => rdr.read_len("tuple")?,
         b')' => rdr.read_u8()? as usize,
         _ => return Err(MarshalError::BadType),
     };
@@ -481,7 +481,7 @@ fn read_marshal_const_tuple<R: Read, Bag: ConstantBag>(
     }
 
     let n = match type_byte {
-        b'(' => rdr.read_u32()? as usize,
+        b'(' => rdr.read_len("tuple")?,
         b')' => rdr.read_u8()? as usize,
         _ => return Err(MarshalError::BadType),
     };