Issue #18408: PyObject_GC_NewVar() now raises SystemError exception if nitems

is negative

diff --git a/Modules/gcmodule.c b/Modules/gcmodule.c
index 51c80b236e67b5ddf0309c0924dda935dc658f90..d96d2c7b68a70e31f84ef53abcd1d300fd21683a 100644 (file)
--- a/Modules/gcmodule.c
+++ b/Modules/gcmodule.c
@@ -1689,8 +1689,15 @@ _PyObject_GC_New(PyTypeObject *tp)
 PyVarObject *
 _PyObject_GC_NewVar(PyTypeObject *tp, Py_ssize_t nitems)
 {
-    const size_t size = _PyObject_VAR_SIZE(tp, nitems);
-    PyVarObject *op = (PyVarObject *) _PyObject_GC_Malloc(size);
+    size_t size;
+    PyVarObject *op;
+
+    if (nitems < 0) {
+        PyErr_BadInternalCall();
+        return NULL;
+    }
+    size = _PyObject_VAR_SIZE(tp, nitems);
+    op = (PyVarObject *) _PyObject_GC_Malloc(size);
     if (op != NULL)
         op = PyObject_INIT_VAR(op, tp, nitems);
     return op;