gh-160781: Fix BytesIO overflow handling for large sizes

BytesIO.write() at a position near sys.maxsize raised SystemError
("Negative size passed to PyBytes_FromStringAndSize") because the
overallocated buffer size could exceed PY_SSIZE_T_MAX.  Check the
computed allocation, not only the requested size.

BytesIO.truncate() converted its argument with PyLong_AsLong(), which
rejects sizes above 2**31 - 1 on Windows where C long is 32-bit.  Use
PyNumber_AsSsize_t() like the Py_ssize_t Argument Clinic converter it
used before.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: cmaloney

Lib/test/test_io/test_memoryio.py

@@ -591,6 +591,10 @@ def test_issue141311(self):
         self.assertEqual(sys.maxsize, memio.seek(sys.maxsize))
         buf = bytearray(2)
         self.assertEqual(0, memio.readinto(buf))
+        # Writing there must not overflow the buffer size.
+        memio.seek(sys.maxsize - 1)
+        self.assertRaises((MemoryError, OverflowError), memio.write, b"x")
+        self.assertEqual(memio.getvalue(), b"")
 
     def test_peek(self):
         buf = self.buftype("1234567890")
@@ -984,6 +988,11 @@ def __index__(self):
             finally:
                 size.result.release()
 
+        # Sizes above 2**31 - 1 must work where C long is 32-bit.
+        stream = self.ioclass(b'abc')
+        self.assertEqual(stream.truncate(2**31), 2**31)
+        self.assertEqual(stream.getvalue(), b'abc')
+
     def test_readinto_overlapping_buffer(self):
         with self.ioclass(b'abcd') as stream:
             with stream.getbuffer()[1:] as target:

Misc/NEWS.d/next/Library/2026-10-27-15-26-53.gh-issue-160781.4VSeQK.rst

@@ -0,0 +1,3 @@
+Fix :class:`io.BytesIO` raising :exc:`SystemError` instead of
+:exc:`OverflowError` when writing at a position close to
+:data:`sys.maxsize`.

Misc/NEWS.d/next/Library/2026-10-27-15-42-16.gh-issue-160781.VGLB9S.rst

@@ -0,0 +1,2 @@
+Fix :meth:`io.BytesIO.truncate` rejecting sizes larger than ``2**31 - 1`` on
+Windows.

Modules/_io/bytesio.c

@@ -221,6 +221,9 @@ resize_buffer_lock_held(bytesio *self, size_t size)
         /* Major upsize; resize up to exact size */
         alloc = size + 1;
     }
+    if (alloc > PY_SSIZE_T_MAX) {
+        goto overflow;
+    }
 
     if (SHARED_BUF(self)) {
         if (unshare_buffer_lock_held(self, alloc) < 0)
@@ -755,7 +758,7 @@ _io_BytesIO_truncate_impl(bytesio *self, PyObject *size)
         new_size = self->pos;
     }
     else {
-        new_size = PyLong_AsLong(size);
+        new_size = PyNumber_AsSsize_t(size, PyExc_OverflowError);
         if (new_size == -1 && PyErr_Occurred()) {
             return NULL;
         }