Report a size that cannot be allocated instead of aborting on it

A size taken from Python went straight into an infallible allocation in several places, so the process aborted through handle_alloc_error before any exception could be raised: - str/bytes/bytearray center(), ljust(), rjust() and zfill() reserved the padded result for the caller's width - expandtabs() built its runs of spaces from a tabsize of any width; the argument is a C int, and a wider one does not fit - Buffered{Reader,Writer,Random} allocated buffer_size, and read(), read1() and FileIO.read() their read size - bytes(n) and bytearray(n) allocated n - pbkdf2_hmac() allocated the derived key length, which is a C int Each of these now reports MemoryError, or OverflowError where the argument does not fit the type it is declared with. new_zeroed_bytes() leaves the zeroing to the allocator, so a large request costs the pages that are written to rather than all of them. Assisted-by: Claude
youknowone · Aug 16, 2026 · Aug 14, 2026 · Aug 14, 2026 · Aug 14, 2026 · Aug 14, 2026
commit 02a6193099e1a87b84e8ae59d64a2937f48d9113
diff --git a/crates/common/src/str.rs b/crates/common/src/str.rs
@@ -592,20 +592,21 @@ pub fn codepoint_range_end(s: &Wtf8, n_chars: usize) -> Option<usize> {
 }
 
 #[must_use]
-pub fn zfill(bytes: &[u8], width: usize) -> Vec<u8> {
+/// Returns `None` for a width whose result cannot be allocated.
+pub fn zfill(bytes: &[u8], width: usize) -> Option<Vec<u8>> {
     if width <= bytes.len() {
-        bytes.to_vec()
-    } else {
-        let (sign, s) = match bytes.first() {
-            Some(_sign @ (b'+' | b'-')) => (unsafe { bytes.get_unchecked(..1) }, &bytes[1..]),
-            _ => (&b""[..], bytes),
-        };
-        let mut filled = Vec::new();
-        filled.extend_from_slice(sign);
-        filled.extend(core::iter::repeat_n(b'0', width - bytes.len()));
-        filled.extend_from_slice(s);
-        filled
+        return Some(bytes.to_vec());
     }
+    let (sign, s) = match bytes.first() {
+        Some(_sign @ (b'+' | b'-')) => (unsafe { bytes.get_unchecked(..1) }, &bytes[1..]),
+        _ => (&b""[..], bytes),
+    };
+    let mut filled = Vec::new();
+    filled.try_reserve_exact(width).ok()?;
+    filled.extend_from_slice(sign);
+    filled.extend(core::iter::repeat_n(b'0', width - bytes.len()));
+    filled.extend_from_slice(s);
+    Some(filled)
 }
 
 /// Convert a string to ascii compatible, escaping unicode-s into escape

diff --git a/crates/stdlib/src/hashlib.rs b/crates/stdlib/src/hashlib.rs
@@ -847,8 +847,8 @@ pub(crate) mod _hashlib {
                 if len < 1 {
                     return Err(vm.new_value_error("key length must be greater than 0."));
                 }
-                usize::try_from(len)
-                    .map_err(|_| vm.new_overflow_error("key length is too great."))?
+                i32::try_from(len).map_err(|_| vm.new_overflow_error("key length is too great."))?
+                    as usize
             }
             None => hash_digest_size(&name).ok_or_else(|| unsupported_hash(&name, vm))?,
         };

diff --git a/crates/vm/src/anystr.rs b/crates/vm/src/anystr.rs
@@ -27,7 +27,7 @@ pub struct SplitLinesArgs {
 #[derive(FromArgs)]
 pub struct ExpandTabsArgs {
     #[pyarg(any, default = 8)]
-    tabsize: isize,
+    tabsize: i32,
 }
 
 impl ExpandTabsArgs {
@@ -132,6 +132,11 @@ where
 {
     fn new() -> Self;
     fn with_capacity(capacity: usize) -> Self;
+    /// `with_capacity`, reporting a capacity that cannot be allocated instead
+    /// of aborting the process on it.
+    fn try_with_capacity(capacity: usize) -> Option<Self>
+    where
+        Self: Sized;
     fn push_str(&mut self, s: &S);
 }
 
@@ -285,27 +290,29 @@ pub(crate) trait AnyStr {
         }
     }
 
-    fn py_pad(&self, left: usize, right: usize, fillchar: Self::Char) -> Self::Container {
-        let mut u = Self::Container::with_capacity(
-            (left + right) * fillchar.bytes_len() + self.bytes_len(),
-        );
+    fn py_pad(&self, left: usize, right: usize, fillchar: Self::Char) -> Option<Self::Container> {
+        let capacity = left
+            .checked_add(right)?
+            .checked_mul(fillchar.bytes_len())?
+            .checked_add(self.bytes_len())?;
+        let mut u = Self::Container::try_with_capacity(capacity)?;
         u.extend(core::iter::repeat_n(fillchar, left));
         u.push_str(self);
         u.extend(core::iter::repeat_n(fillchar, right));
-        u
+        Some(u)
     }
 
-    fn py_center(&self, width: usize, fillchar: Self::Char, len: usize) -> Self::Container {
+    fn py_center(&self, width: usize, fillchar: Self::Char, len: usize) -> Option<Self::Container> {
         let marg = width - len;
         let left = marg / 2 + (marg & width & 1);
         self.py_pad(left, marg - left, fillchar)
     }
 
-    fn py_ljust(&self, width: usize, fillchar: Self::Char, len: usize) -> Self::Container {
+    fn py_ljust(&self, width: usize, fillchar: Self::Char, len: usize) -> Option<Self::Container> {
         self.py_pad(0, width - len, fillchar)
     }
 
-    fn py_rjust(&self, width: usize, fillchar: Self::Char, len: usize) -> Self::Container {
+    fn py_rjust(&self, width: usize, fillchar: Self::Char, len: usize) -> Option<Self::Container> {
         self.py_pad(width - len, 0, fillchar)
     }
 
@@ -402,7 +409,7 @@ pub(crate) trait AnyStr {
         elements
     }
 
-    fn py_zfill(&self, width: isize) -> Vec<u8> {
+    fn py_zfill(&self, width: isize) -> Option<Vec<u8>> {
         let width = width.to_usize().unwrap_or(0);
         let char_len = self.elements().count();
         let width = self

diff --git a/crates/vm/src/builtins/bytearray.rs b/crates/vm/src/builtins/bytearray.rs
@@ -497,8 +497,8 @@ impl PyByteArray {
     }
 
     #[pymethod]
-    fn zfill(&self, width: isize) -> Self {
-        self.inner().zfill(width).into()
+    fn zfill(&self, width: isize, vm: &VirtualMachine) -> PyResult<Self> {
+        Ok(self.inner().zfill(width, vm)?.into())
     }
 
     #[pymethod]

diff --git a/crates/vm/src/builtins/bytes.rs b/crates/vm/src/builtins/bytes.rs
@@ -505,8 +505,8 @@ impl PyBytes {
     }
 
     #[pymethod]
-    fn zfill(&self, width: isize) -> Self {
-        self.inner.zfill(width).into()
+    fn zfill(&self, width: isize, vm: &VirtualMachine) -> PyResult<Self> {
+        Ok(self.inner.zfill(width, vm)?.into())
     }
 
     #[pymethod]

diff --git a/crates/vm/src/builtins/str.rs b/crates/vm/src/builtins/str.rs
@@ -1320,31 +1320,33 @@ impl PyStr {
     }
 
     #[pymethod]
-    fn zfill(&self, width: isize) -> Wtf8Buf {
-        unsafe {
-            // SAFETY: this is safe-guaranteed because the original self.as_wtf8() is valid wtf8
-            Wtf8Buf::from_bytes_unchecked(self.as_wtf8().py_zfill(width))
-        }
+    fn zfill(&self, width: isize, vm: &VirtualMachine) -> PyResult<Wtf8Buf> {
+        let filled = self
+            .as_wtf8()
+            .py_zfill(width)
+            .ok_or_else(|| vm.new_memory_error(""))?;
+        // SAFETY: this is safe-guaranteed because the original self.as_wtf8() is valid wtf8
+        Ok(unsafe { Wtf8Buf::from_bytes_unchecked(filled) })
     }
 
     #[inline]
     fn _pad(
         &self,
         width: isize,
         fillchar: OptionalArg<PyStrRef>,
-        pad: fn(&Wtf8, usize, CodePoint, usize) -> Wtf8Buf,
+        pad: fn(&Wtf8, usize, CodePoint, usize) -> Option<Wtf8Buf>,
         vm: &VirtualMachine,
     ) -> PyResult<Wtf8Buf> {
         let fillchar = fillchar.map_or(Ok(' '.into()), |ref s| {
             s.as_wtf8().code_points().exactly_one().map_err(|_| {
                 vm.new_type_error("The fill character must be exactly one character long")
             })
         })?;
-        Ok(if self.len() as isize >= width {
-            self.as_wtf8().to_owned()
-        } else {
-            pad(self.as_wtf8(), width as usize, fillchar, self.len())
-        })
+        if self.len() as isize >= width {
+            return Ok(self.as_wtf8().to_owned());
+        }
+        pad(self.as_wtf8(), width as usize, fillchar, self.len())
+            .ok_or_else(|| vm.new_memory_error(""))
     }
 
     #[pymethod]
@@ -2214,6 +2216,12 @@ impl AnyStrContainer<str> for String {
         Self::with_capacity(capacity)
     }
 
+    fn try_with_capacity(capacity: usize) -> Option<Self> {
+        let mut s = Self::new();
+        s.try_reserve_exact(capacity).ok()?;
+        Some(s)
+    }
+
     fn push_str(&mut self, other: &str) {
         Self::push_str(self, other)
     }
@@ -2327,6 +2335,12 @@ impl AnyStrContainer<Wtf8> for Wtf8Buf {
         Self::with_capacity(capacity)
     }
 
+    fn try_with_capacity(capacity: usize) -> Option<Self> {
+        let mut s = Self::new();
+        s.try_reserve_exact(capacity).ok()?;
+        Some(s)
+    }
+
     fn push_str(&mut self, other: &Wtf8) {
         self.push_wtf8(other)
     }
@@ -2447,6 +2461,12 @@ impl AnyStrContainer<AsciiStr> for AsciiString {
         Self::with_capacity(capacity)
     }
 
+    fn try_with_capacity(capacity: usize) -> Option<Self> {
+        let mut v = Vec::new();
+        v.try_reserve_exact(capacity).ok()?;
+        Some(Self::from(v))
+    }
+
     fn push_str(&mut self, other: &AsciiStr) {
         Self::push_str(self, other)
     }

diff --git a/crates/vm/src/bytes_inner.rs b/crates/vm/src/bytes_inner.rs
@@ -78,7 +78,7 @@ impl ByteInnerNewOptions {
         } else {
             size as usize
         };
-        Ok(vec![0; size].into())
+        Ok(vm.new_zeroed_bytes(size)?.into())
     }
 
     fn handle_object_fallback(obj: PyObjectRef, vm: &VirtualMachine) -> PyResult<PyBytesInner> {
@@ -576,16 +576,15 @@ impl PyBytesInner {
     fn _pad(
         &self,
         options: ByteInnerPaddingOptions,
-        pad: fn(&[u8], usize, u8, usize) -> Vec<u8>,
+        pad: PadFn,
         vm: &VirtualMachine,
     ) -> PyResult<Vec<u8>> {
         let (width, fillchar) = options.get_value("center", vm)?;
         let len = self.len();
-        Ok(if len as isize >= width {
-            Vec::from(&self.elements[..])
-        } else {
-            pad(&self.elements, width as usize, fillchar, len)
-        })
+        if len as isize >= width {
+            return Ok(Vec::from(&self.elements[..]));
+        }
+        pad(&self.elements, width as usize, fillchar, len).ok_or_else(|| vm.new_memory_error(""))
     }
 
     pub fn center(
@@ -821,8 +820,10 @@ impl PyBytesInner {
         self.elements.py_bytes_splitlines(options, into_wrapper)
     }
 
-    pub fn zfill(&self, width: isize) -> Vec<u8> {
-        self.elements.py_zfill(width)
+    pub fn zfill(&self, width: isize, vm: &VirtualMachine) -> PyResult<Vec<u8>> {
+        self.elements
+            .py_zfill(width)
+            .ok_or_else(|| vm.new_memory_error(""))
     }
 
     // len(self)>=1, from="", len(to)>=1, max_count>=1
@@ -1077,11 +1078,21 @@ impl AnyStrContainer<[u8]> for Vec<u8> {
         Self::with_capacity(capacity)
     }
 
+    fn try_with_capacity(capacity: usize) -> Option<Self> {
+        let mut v = Self::new();
+        v.try_reserve_exact(capacity).ok()?;
+        Some(v)
+    }
+
     fn push_str(&mut self, other: &[u8]) {
         self.extend(other)
     }
 }
 
+/// A padding function from `AnyStr`, returning `None` for a width whose result
+/// cannot be allocated.
+type PadFn = fn(&[u8], usize, u8, usize) -> Option<Vec<u8>>;
+
 const ASCII_WHITESPACES: [u8; 6] = [0x20, 0x09, 0x0a, 0x0c, 0x0d, 0x0b];
 
 impl anystr::AnyChar for u8 {

diff --git a/crates/vm/src/stdlib/_io.rs b/crates/vm/src/stdlib/_io.rs
@@ -1258,7 +1258,7 @@ mod _io {
 
             let current_size = self.readahead() as usize;
 
-            let mut out = vec![0u8; n];
+            let mut out = vm.new_zeroed_bytes(n)?;
             let mut remaining = n;
             let mut written = 0;
             if current_size > 0 {
@@ -1673,7 +1673,7 @@ mod _io {
                 check_writable(&raw, vm)?;
             }
 
-            data.buffer = vec![0; buffer_size];
+            data.buffer = vm.new_zeroed_bytes(buffer_size)?;
 
             if Self::READABLE {
                 data.reset_read();
@@ -1938,7 +1938,7 @@ mod _io {
             if data.writable() {
                 data.flush_rewind(vm)?;
             }
-            let mut v = vec![0; n];
+            let mut v = vm.new_zeroed_bytes(n)?;
             data.reset_read();
             let r = data
                 .raw_read(Either::A(Some(&mut v)), 0..n, vm)?
@@ -5767,7 +5767,7 @@ mod fileio {
             }
             let handle = zelf.get_fd(vm)?;
             let bytes = if let Some(read_byte) = read_byte.to_usize() {
-                let mut bytes = vec![0; read_byte];
+                let mut bytes = vm.new_zeroed_bytes(read_byte)?;
                 // Loop on EINTR (PEP 475)
                 let n = loop {
                     match vm.allow_threads(|| host_io::read_once(handle, &mut bytes)) {

diff --git a/crates/vm/src/vm/vm_ops.rs b/crates/vm/src/vm/vm_ops.rs
@@ -168,6 +168,27 @@ impl VirtualMachine {
         }
     }
 
+    /// `vec![0; len]` for a length that came from Python, where a request too
+    /// large to satisfy is a `MemoryError` rather than an aborted process.
+    ///
+    /// The bytes are left for the allocator to zero, so a large request costs
+    /// no more than the pages that are actually written to.
+    pub fn new_zeroed_bytes(&self, len: usize) -> PyResult<Vec<u8>> {
+        if len == 0 {
+            return Ok(Vec::new());
+        }
+        let layout =
+            core::alloc::Layout::array::<u8>(len).map_err(|_| self.new_memory_error(""))?;
+        // SAFETY: `len` is not zero, so neither is the layout's size.
+        let ptr = unsafe { alloc::alloc::alloc_zeroed(layout) };
+        if ptr.is_null() {
+            return Err(self.new_memory_error(""));
+        }
+        // SAFETY: `ptr` was just allocated by the global allocator for exactly
+        // this many bytes, and every one of them is initialized to zero.
+        Ok(unsafe { Vec::from_raw_parts(ptr, len, len) })
+    }
+
     /// Calling scheme used for binary operations:
     ///
     /// Order operations are tried until either a valid result or error:

diff --git a/extra_tests/snippets/builtin_bytes.py b/extra_tests/snippets/builtin_bytes.py
@@ -747,3 +747,22 @@ def __new__(cls, value):
 assert "123A".istitle(), f"{s}"
 assert not "123a".istitle(), f"{s}"
 assert not "123A\ta".istitle(), f"{s}"
+
+
+def test_huge_size():
+    # sizes that cannot be allocated are MemoryError, not an aborted process
+    for factory in (bytes, bytearray):
+        assert_raises(MemoryError, lambda factory=factory: factory(2**62))
+        for meth in ("center", "ljust", "rjust", "zfill"):
+            assert_raises(
+                MemoryError,
+                lambda factory=factory, meth=meth: getattr(factory(b"a"), meth)(
+                    1 << 62
+                ),
+            )
+        assert_raises(
+            OverflowError, lambda factory=factory: factory(b"\ta").expandtabs(2**31)
+        )
+
+
+test_huge_size()
diff --git a/extra_tests/snippets/builtin_str.py b/extra_tests/snippets/builtin_str.py
@@ -900,3 +900,16 @@ class MyString(str):
 assert id(b) != id(b * 1)
 assert id(b) != id(1 * b)
 assert id(b) != id(b * 2)
+
+
+def test_huge_width():
+    # A width that cannot be allocated is a MemoryError, not an aborted
+    # process, and a tabsize wider than a C int does not fit at all.
+    for meth in ("center", "ljust", "rjust", "zfill"):
+        assert_raises(MemoryError, lambda meth=meth: getattr("a", meth)(1 << 62))
+    assert_raises(OverflowError, lambda: "\ta".expandtabs(1 << 62))
+    assert_raises(OverflowError, lambda: "\ta".expandtabs(2**31))
+    assert "\ta".expandtabs(2**31 - 1)[-1] == "a"
+
+
+test_huge_width()