Raise SystemError when size < 0 is passed into PyString_FromStringAndSize,

PyBytes_FromStringAndSize or PyUnicode_FromStringAndSize.  [issue2587]

diff --git a/Objects/bytesobject.c b/Objects/bytesobject.c
index 23de37e07a9bcf4590b849b4e4d32e42ae8fa3b5..af7a1b18d96b9a3bdf8e69033058d7fe4d1b403e 100644 (file)
--- a/Objects/bytesobject.c
+++ b/Objects/bytesobject.c
@@ -161,6 +161,11 @@ PyBytes_FromStringAndSize(const char *bytes, Py_ssize_t size)
     Py_ssize_t alloc;
 
     assert(size >= 0);
+    if (size < 0) {
+        PyErr_SetString(PyExc_SystemError,
+            "Negative size passed to PyBytes_FromStringAndSize");
+        return NULL;
+    }
 
     new = PyObject_New(PyBytesObject, &PyBytes_Type);
     if (new == NULL)

diff --git a/Objects/stringobject.c b/Objects/stringobject.c
index 4c36e4bee8c05674c2d5151f2fb308204a6f001a..f4b42641f0fe75d363efb0e21b5022ffb159fb0d 100644 (file)
--- a/Objects/stringobject.c
+++ b/Objects/stringobject.c
@@ -56,6 +56,11 @@ PyString_FromStringAndSize(const char *str, Py_ssize_t size)
 {
        register PyStringObject *op;
        assert(size >= 0);
+       if (size < 0) {
+               PyErr_SetString(PyExc_SystemError,
+                   "Negative size passed to PyString_FromStringAndSize");
+               return NULL;
+       }
        if (size == 0 && (op = nullstring) != NULL) {
 #ifdef COUNT_ALLOCS
                null_strings++;

diff --git a/Objects/unicodeobject.c b/Objects/unicodeobject.c
index 75ad9f0832ae393018cbed9537392facefc3c72e..43379728cbbae4354d7374ff7f6e700df0fd4bf2 100644 (file)
--- a/Objects/unicodeobject.c
+++ b/Objects/unicodeobject.c
@@ -465,6 +465,14 @@ PyObject *PyUnicode_FromUnicode(const Py_UNICODE *u,
 PyObject *PyUnicode_FromStringAndSize(const char *u, Py_ssize_t size)
 {
     PyUnicodeObject *unicode;
+
+       assert(size <= 0);
+       if (size < 0) {
+               PyErr_SetString(PyExc_SystemError,
+                   "Negative size passed to PyUnicode_FromStringAndSize");
+               return NULL;
+       }
+
     /* If the Unicode data is known at construction time, we can apply
        some optimizations which share commonly used objects.
        Also, this means the input must be UTF-8, so fall back to the