numpy
diff --git a/‎numpy/_core/src/multiarray/ctors.c
Copy file name to clipboardExpand all lines: numpy/_core/src/multiarray/ctors.c
+21-2Lines changed: 21 additions & 2 deletions b/‎numpy/_core/src/multiarray/ctors.c
Copy file name to clipboardExpand all lines: numpy/_core/src/multiarray/ctors.c
+21-2Lines changed: 21 additions & 2 deletions
diff --git a/‎numpy/_core/tests/test_multiarray.py
Copy file name to clipboardExpand all lines: numpy/_core/tests/test_multiarray.py
+21Lines changed: 21 additions & 0 deletions b/‎numpy/_core/tests/test_multiarray.py
Copy file name to clipboardExpand all lines: numpy/_core/tests/test_multiarray.py
+21Lines changed: 21 additions & 0 deletions
@@ -2249,14 +2249,21 @@ PyArray_FromInterface(PyObject *origin)
     }
     /* Get dimensions from shape tuple */
     else {
-        n = PyTuple_GET_SIZE(attr);
-        for (i = 0; i < n; i++) {
+        Py_ssize_t shape_tuple_len = PyTuple_GET_SIZE(attr);
+        if (shape_tuple_len > NPY_MAXDIMS) {
+            PyErr_Format(PyExc_ValueError,
+                         "number of dimensions must be within [0, %d], got %d",
+                         NPY_MAXDIMS, shape_tuple_len);
+            goto fail;
+        }
+        for (i = 0; i < shape_tuple_len; i++) {
             PyObject *tmp = PyTuple_GET_ITEM(attr, i);
             dims[i] = PyArray_PyIntAsIntp(tmp);
             if (error_converting(dims[i])) {
                 goto fail;
             }
         }
+        n = (int)shape_tuple_len;
     }
     Py_CLEAR(attr);
 
@@ -4140,6 +4147,12 @@ _array_fill_strides(npy_intp *strides, npy_intp const *dims, int nd, size_t item
         for (i = 0; i < nd; i++) {
             strides[i] = itemsize;
             if (dims[i]) {
+                npy_intp tmp;
+                if (npy_mul_sizes_with_overflow(&tmp, (npy_intp)itemsize, dims[i])) {
+                    PyErr_SetString(PyExc_ValueError,
+                            "array is too big; overflow in _array_fill_strides.");
+                    return;
+                }
                 itemsize *= dims[i];
             }
             else {
@@ -4158,6 +4171,12 @@ _array_fill_strides(npy_intp *strides, npy_intp const *dims, int nd, size_t item
         for (i = nd - 1; i >= 0; i--) {
             strides[i] = itemsize;
             if (dims[i]) {
+                npy_intp tmp;
+                if (npy_mul_sizes_with_overflow(&tmp, (npy_intp)itemsize, dims[i])) {
+                    PyErr_SetString(PyExc_ValueError,
+                            "array is too big; overflow in _array_fill_strides.");
+                    return;
+                }
                 itemsize *= dims[i];
             }
             else {
 
@@ -10420,3 +10420,24 @@ def test_to_device(self):
             r"The stream argument in to_device\(\) is not supported"
         ):
             arr.to_device("cpu", stream=1)
+
+def test_array_interface_excess_dimensions_raises():
+    """Regression test for gh-27949: ensure too many dims raises ValueError instead of segfault."""
+    
+    # Dummy object to hold a custom __array_interface__
+    class DummyArray:
+        def __init__(self, interface):
+            # Attach the array interface dict to mimic an array
+            self.__array_interface__ = interface
+
+    # Create a base array (scalar) and copy its interface
+    base = np.array(42)  # base can be any scalar or array
+    interface = dict(base.__array_interface__)
+
+    # Modify the shape to exceed NumPy's dimension limit (NPY_MAXDIMS, typically 64)
+    interface['shape'] = tuple([1] * 136)  # match the original bug report 
+
+    dummy = DummyArray(interface)
+    # Now, using np.asanyarray on this dummy should trigger a ValueError (not segfault)
+    with pytest.raises(ValueError, match="dimensions must be within"):
+        np.asanyarray(dummy)