merge 3.3

diff --cc Lib/test/test_json/test_decode.py
index 35c02de88cc6e4f7bf8375ef8d8e5a2f69bcf2c2,17245ebc4810965fafca6004c477a1b071b0f5f6..591b2e253df69bb3a2d6275578a3d29aae3b6a89
--- 1/Lib/test/test_json/test_decode.py
--- 2/Lib/test/test_json/test_decode.py
+++ b/Lib/test/test_json/test_decode.py
@@@ -70,26 -70,9 +70,30 @@@ class TestDecode
          msg = 'escape'
          self.assertRaisesRegex(ValueError, msg, self.loads, s)
  
 +    def test_invalid_input_type(self):
 +        msg = 'the JSON object must be str'
 +        for value in [1, 3.14, b'bytes', b'\xff\x00', [], {}, None]:
 +            self.assertRaisesRegex(TypeError, msg, self.loads, value)
 +        with self.assertRaisesRegex(TypeError, msg):
 +            self.json.load(BytesIO(b'[1,2,3]'))
 +
 +    def test_string_with_utf8_bom(self):
 +        # see #18958
 +        bom_json = "[1,2,3]".encode('utf-8-sig').decode('utf-8')
 +        with self.assertRaises(ValueError) as cm:
 +            self.loads(bom_json)
 +        self.assertIn('BOM', str(cm.exception))
 +        with self.assertRaises(ValueError) as cm:
 +            self.json.load(StringIO(bom_json))
 +        self.assertIn('BOM', str(cm.exception))
 +        # make sure that the BOM is not detected in the middle of a string
 +        bom_in_str = '"{}"'.format(''.encode('utf-8-sig').decode('utf-8'))
 +        self.assertEqual(self.loads(bom_in_str), '\ufeff')
 +        self.assertEqual(self.json.load(StringIO(bom_in_str)), '\ufeff')
 +
+     def test_negative_index(self):
+         d = self.json.JSONDecoder()
+         self.assertRaises(ValueError, d.raw_decode, 'a'*42, -50000)
+ 
  class TestPyDecode(TestDecode, PyTest): pass
  class TestCDecode(TestDecode, CTest): pass

diff --cc Misc/ACKS
Simple merge

diff --cc Misc/NEWS
index 74c5e50cdd7cc7364a538a0d23b1a75e5b6d10f4,2ca47f047be959b5431b773ed636c46e10bbe0bc..6fc6e2fbd6de05451ea8a3b6cd27e0d1d46c924f
--- 1/Misc/NEWS
--- 2/Misc/NEWS
+++ b/Misc/NEWS
@@@ -27,35 -13,11 +27,38 @@@ Core and Builtin
  Library
  -------
  
+ - Fix arbitrary memory access in JSONDecoder.raw_decode with a negative second
+   parameter. Bug reported by Guido Vranken.
+ 
 +- Issue #21169: getpass now handles non-ascii characters that the
 +  input stream encoding cannot encode by re-encoding using the
 +  replace error handler.
 +
 +- Issue #21171: Fixed undocumented filter API of the rot13 codec.
 +  Patch by Berker Peksag.
 +
 +- Issue #21172: isinstance check relaxed from dict to collections.Mapping.
 +
 +- Issue #21155: asyncio.EventLoop.create_unix_server() now raises a ValueError
 +  if path and sock are specified at the same time.
 +
 +- Issue #21149: Improved thread-safety in logging cleanup during interpreter
 +  shutdown. Thanks to Devin Jeanpierre for the patch.
 +
 +- Issue #20145: `assertRaisesRegex` and `assertWarnsRegex` now raise a
 +  TypeError if the second argument is not a string or compiled regex.
 +
 +- Issue #21058: Fix a leak of file descriptor in
 +  :func:`tempfile.NamedTemporaryFile`, close the file descriptor if
 +  :func:`io.open` fails
 +
 +- Issue #21013: Enhance ssl.create_default_context() when used for server side
 +  sockets to provide better security by default.
 +
  - Issue #20633: Replace relative import by absolute import.
  
 +- Issue #20980: Stop wrapping exception when using ThreadPool.
 +
  - Issue #21082: In os.makedirs, do not set the process-wide umask. Note this
    changes behavior of makedirs when exist_ok=True.
  

diff --cc Modules/_json.c
index 125101fa7c38ca625b462354fa90b6517a34db42,ec980c93fa1ee478335990c6196001dbeb76cdcf..7d627cb2c5494733da6cf9d57c1f2ac4d03832a5
--- 1/Modules/_json.c
--- 2/Modules/_json.c
+++ b/Modules/_json.c
@@@ -941,8 -975,11 +941,11 @@@ scan_once_unicode(PyScannerObject *s, P
      kind = PyUnicode_KIND(pystr);
      length = PyUnicode_GET_LENGTH(pystr);
  
-     if (idx >= length) {
+     if (idx < 0)
+         /* Compatibility with Python version. */
+         idx += length;
+     if (idx < 0 || idx >= length) {
 -        PyErr_SetNone(PyExc_StopIteration);
 +        raise_stop_iteration(idx);
          return NULL;
      }