Int overflow

code/ndarray.c

@@ -622,6 +622,10 @@ ndarray_obj_t *ndarray_new_ndarray(uint8_t ndim, size_t *shape, int32_t *strides
         ndarray->len = multiply_size(ndarray->len, shape[i-1]);
     }
 
+    if (SIZE_MAX / ndarray->itemsize <= ndarray->len) {
+      mp_raise_ValueError(translate("ndarray length overflows"));
+    }
+
     // if the length is 0, still allocate a single item, so that contractions can be handled
     size_t len = multiply_size(ndarray->itemsize, MAX(1, ndarray->len));
     uint8_t *array = m_new0(byte, len);

code/numpy/create.c

@@ -158,7 +158,7 @@ mp_obj_t create_arange(size_t n_args, const mp_obj_t *pos_args, mp_map_t *kw_arg
         mp_raise_msg(&mp_type_ZeroDivisionError, MP_ERROR_TEXT("divide by zero"));
     }
 
-    if(isnan(start) || isnan(stop) || isnan(step)) {
+    if(!isfinite(start) || !isfinite(stop) || !isfinite(step)) {
         mp_raise_ValueError(translate("arange: cannot compute length"));
     }
 

code/numpy/poly.c

@@ -161,7 +161,7 @@ mp_obj_t poly_polyval(mp_obj_t o_p, mp_obj_t o_x) {
     }
     #endif
     // p had better be a one-dimensional standard iterable
-    uint8_t plen = mp_obj_get_int(mp_obj_len_maybe(o_p));
+    size_t plen = (size_t)mp_obj_get_int(mp_obj_len_maybe(o_p));
     mp_float_t *p = m_new(mp_float_t, plen);
     mp_obj_iter_buf_t p_buf;
     mp_obj_t p_item, p_iterable = mp_getiter(o_p, &p_buf);

code/ulab.c

@@ -33,7 +33,7 @@
 #include "user/user.h"
 #include "utils/utils.h"
 
-#define ULAB_VERSION 6.3.0
+#define ULAB_VERSION 6.3.1
 #define xstr(s) str(s)
 #define str(s) #s