python
diff --git a/‎Lib/test/test_buffer.py
Copy file name to clipboardExpand all lines: Lib/test/test_buffer.py
+15Lines changed: 15 additions & 0 deletions b/‎Lib/test/test_buffer.py
Copy file name to clipboardExpand all lines: Lib/test/test_buffer.py
+15Lines changed: 15 additions & 0 deletions
diff --git a/‎Objects/typeobject.c
Copy file name to clipboardExpand all lines: Objects/typeobject.c
+3-3Lines changed: 3 additions & 3 deletions b/‎Objects/typeobject.c
Copy file name to clipboardExpand all lines: Objects/typeobject.c
+3-3Lines changed: 3 additions & 3 deletions
@@ -4442,6 +4442,21 @@ def test_pybuffer_size_from_format(self):
             self.assertEqual(_testcapi.PyBuffer_SizeFromFormat(format),
                              struct.calcsize(format))
 
+    @support.cpython_only
+    def test_flags_overflow(self):
+        # gh-126594: Check for integer overlow on large flags
+        try:
+            from _testcapi import INT_MIN, INT_MAX
+        except ImportError:
+            INT_MIN = -(2 ** 31)
+            INT_MAX = 2 ** 31 - 1
+
+        obj = b'abc'
+        for flags in (INT_MIN - 1, INT_MAX + 1):
+            with self.subTest(flags=flags):
+                with self.assertRaises(OverflowError):
+                    obj.__buffer__(flags)
+
 
 class TestPythonBufferProtocol(unittest.TestCase):
     def test_basic(self):
 
@@ -8207,13 +8207,13 @@ wrap_buffer(PyObject *self, PyObject *args, void *wrapped)
     if (flags == -1 && PyErr_Occurred()) {
         return NULL;
     }
-    if (flags > INT_MAX) {
+    if (flags > INT_MAX || flags < INT_MIN) {
         PyErr_SetString(PyExc_OverflowError,
-                        "buffer flags too large");
+                        "buffer flags out of range");
         return NULL;
     }
 
-    return _PyMemoryView_FromBufferProc(self, Py_SAFE_DOWNCAST(flags, Py_ssize_t, int),
+    return _PyMemoryView_FromBufferProc(self, (int)flags,
                                         (getbufferproc)wrapped);
 }
Original file line number	Diff line number	Diff line change
`@@ -8207,13 +8207,13 @@ wrap_buffer(PyObject self, PyObject args, void *wrapped)`
`8207`	`8207`	`if (flags == -1 && PyErr_Occurred()) {`
`8208`	`8208`	`return NULL;`
`8209`	`8209`	`}`
`8210`		`- if (flags > INT_MAX) {`
	`8210`	`+ if (flags > INT_MAX \|\| flags < INT_MIN) {`
`8211`	`8211`	`PyErr_SetString(PyExc_OverflowError,`
`8212`		`- "buffer flags too large");`
	`8212`	`+ "buffer flags out of range");`
`8213`	`8213`	`return NULL;`
`8214`	`8214`	`}`
`8215`	`8215`
`8216`		`- return _PyMemoryView_FromBufferProc(self, Py_SAFE_DOWNCAST(flags, Py_ssize_t, int),`
	`8216`	`+ return _PyMemoryView_FromBufferProc(self, (int)flags,`
`8217`	`8217`	`(getbufferproc)wrapped);`
`8218`	`8218`	`}`
`8219`	`8219`