BUG: Prevent passing of size 0 to array alloc C functions

5 files changed, 30 insertions, 10 deletions

diff --git a/numpy/core/src/multiarray/alloc.c b/numpy/core/src/multiarray/alloc.c
index 6755095d7..addc9f006 100644
--- a/numpy/core/src/multiarray/alloc.c
+++ b/numpy/core/src/multiarray/alloc.c
@@ -218,6 +218,7 @@ PyDataMem_NEW(size_t size)
 {
     void *result;
 
+    assert(size != 0);
     result = malloc(size);
     if (_PyDataMem_eventhook != NULL) {
         NPY_ALLOW_C_API_DEF
@@ -281,6 +282,7 @@ PyDataMem_RENEW(void *ptr, size_t size)
 {
     void *result;
 
+    assert(size != 0);
     result = realloc(ptr, size);
     if (result != ptr) {
         PyTraceMalloc_Untrack(NPY_TRACE_DOMAIN, (npy_uintp)ptr);
diff --git a/numpy/core/src/multiarray/ctors.c b/numpy/core/src/multiarray/ctors.c
index 04658ed16..9d01132da 100644
--- a/numpy/core/src/multiarray/ctors.c
+++ b/numpy/core/src/multiarray/ctors.c
@@ -3701,13 +3701,17 @@ array_from_text(PyArray_Descr *dtype, npy_intp num, char *sep, size_t *nread,
         }
     }
     if (num < 0) {
-        tmp = PyDataMem_RENEW(PyArray_DATA(r), PyArray_MAX(*nread,1)*dtype->elsize);
-        if (tmp == NULL) {
-            err = 1;
-        }
-        else {
-            PyArray_DIMS(r)[0] = *nread;
-            ((PyArrayObject_fields *)r)->data = tmp;
+        const size_t nsize = PyArray_MAX(*nread,1)*dtype->elsize;
+
+        if (nsize != 0) {
+            tmp = PyDataMem_RENEW(PyArray_DATA(r), nsize);
+            if (tmp == NULL) {
+                err = 1;
+            }
+            else {
+                PyArray_DIMS(r)[0] = *nread;
+                ((PyArrayObject_fields *)r)->data = tmp;
+            }
         }
     }
     NPY_END_ALLOW_THREADS;
@@ -4110,9 +4114,9 @@ PyArray_FromIter(PyObject *obj, PyArray_Descr *dtype, npy_intp count)
      * Realloc the data so that don't keep extra memory tied up
      * (assuming realloc is reasonably good about reusing space...)
      */
-    if (i == 0) {
+    if (i == 0 || elsize == 0) {
         /* The size cannot be zero for PyDataMem_RENEW. */
-        i = 1;
+        goto done;
     }
     new_data = PyDataMem_RENEW(PyArray_DATA(ret), i * elsize);
     if (new_data == NULL) {
diff --git a/numpy/core/src/multiarray/item_selection.c b/numpy/core/src/multiarray/item_selection.c
index c2fa7cbfe..df2a2b52a 100644
--- a/numpy/core/src/multiarray/item_selection.c
+++ b/numpy/core/src/multiarray/item_selection.c
@@ -1516,6 +1516,9 @@ PyArray_LexSort(PyObject *sort_keys, int axis)
         char *valbuffer, *indbuffer;
         int *swaps;
 
+        if (N == 0 || maxelsize == 0 || sizeof(npy_intp) == 0) {
+            goto fail;
+        }
         valbuffer = PyDataMem_NEW(N * maxelsize);
         if (valbuffer == NULL) {
             goto fail;
diff --git a/numpy/core/src/multiarray/methods.c b/numpy/core/src/multiarray/methods.c
index 3f8fcb96d..e8b802a42 100644
--- a/numpy/core/src/multiarray/methods.c
+++ b/numpy/core/src/multiarray/methods.c
@@ -2033,6 +2033,9 @@ array_setstate(PyArrayObject *self, PyObject *args)
         if (!IsAligned(self) || swap || (len <= 1000)) {
 #endif
             npy_intp num = PyArray_NBYTES(self);
+            if (num == 0) {
+                Py_RETURN_NONE;
+            }
             fa->data = PyDataMem_NEW(num);
             if (PyArray_DATA(self) == NULL) {
                 Py_DECREF(rawdata);
@@ -2076,7 +2079,12 @@ array_setstate(PyArrayObject *self, PyObject *args)
         }
     }
     else {
-        fa->data = PyDataMem_NEW(PyArray_NBYTES(self));
+        npy_intp num = PyArray_NBYTES(self);
+        int elsize = PyArray_DESCR(self)->elsize;
+        if (num == 0 || elsize == 0) {
+            Py_RETURN_NONE;
+        }
+        fa->data = PyDataMem_NEW(num);
         if (PyArray_DATA(self) == NULL) {
             return PyErr_NoMemory();
         }
diff --git a/numpy/core/src/multiarray/scalarapi.c b/numpy/core/src/multiarray/scalarapi.c
index bc435d1ca..ee847af9b 100644
--- a/numpy/core/src/multiarray/scalarapi.c
+++ b/numpy/core/src/multiarray/scalarapi.c
@@ -802,6 +802,9 @@ PyArray_Scalar(void *data, PyArray_Descr *descr, PyObject *base)
                     return obj;
                 }
             }
+            if (itemsize == 0) {
+                return obj;
+            }
             destptr = PyDataMem_NEW(itemsize);
             if (destptr == NULL) {
                 Py_DECREF(obj);