merge 3.2

diff --cc Lib/test/test_json/test_decode.py
Simple merge

diff --cc Misc/ACKS
index 2f3a4d15be38ff8c19b6804309b2bd716093a332,a932074975461e3b0e476be8dfca78874d7f2226..ec961e4bc731f84be48e6ada6f36982bab75c676
--- 1/Misc/ACKS
--- 2/Misc/ACKS
+++ b/Misc/ACKS
@@@ -1307,12 -1135,11 +1307,13 @@@ Dino Viehlan
  Kannan Vijayan
  Kurt Vile
  Norman Vine
 +Pauli Virtanen
  Frank Visser
  Johannes Vogel
 +Alex Volkov
  Martijn Vries
  Sjoerd de Vries
+ Guido Vranken
  Niki W. Waibel
  Wojtek Walczak
  Charles Waldman

diff --cc Misc/NEWS
index cd9154683d4b9c07fe95cc0e734e9718e04536d8,e44219a9d7f428ef7c1fa0825a87b24cc256f7b0..2ca47f047be959b5431b773ed636c46e10bbe0bc
--- 1/Misc/NEWS
--- 2/Misc/NEWS
+++ b/Misc/NEWS
@@@ -13,8 -10,9 +13,11 @@@ Core and Builtin
  Library
  -------
  
+ - Fix arbitrary memory access in JSONDecoder.raw_decode with a negative second
+   parameter. Bug reported by Guido Vranken.
+ 
 +- Issue #20633: Replace relative import by absolute import.
 +
  - Issue #21082: In os.makedirs, do not set the process-wide umask. Note this
    changes behavior of makedirs when exist_ok=True.
  

diff --cc Modules/_json.c
index 916668028911cfbe0d30fca5e925b4a5506ace08,5bd52cb78988e6f7855936f8800cef747cd65078..ec980c93fa1ee478335990c6196001dbeb76cdcf
--- 1/Modules/_json.c
--- 2/Modules/_json.c
+++ b/Modules/_json.c
@@@ -964,18 -928,12 +964,21 @@@ scan_once_unicode(PyScannerObject *s, P
      Returns a new PyObject representation of the term.
      */
      PyObject *res;
 -    Py_UNICODE *str = PyUnicode_AS_UNICODE(pystr);
 -    Py_ssize_t length = PyUnicode_GET_SIZE(pystr);
 +    void *str;
 +    int kind;
 +    Py_ssize_t length;
 +
 +    if (PyUnicode_READY(pystr) == -1)
 +        return NULL;
 +
 +    str = PyUnicode_DATA(pystr);
 +    kind = PyUnicode_KIND(pystr);
 +    length = PyUnicode_GET_LENGTH(pystr);
 +
-     if (idx >= length) {
+     if (idx < 0)
+         /* Compatibility with Python version. */
+         idx += length;
+     if (idx < 0 || idx >= length) {
          PyErr_SetNone(PyExc_StopIteration);
          return NULL;
      }