From: Benjamin Peterson <benjamin@python.org>
Date: Mon, 14 Apr 2014 02:28:16 +0000 (-0400)
Subject: merge 3.2
X-Git-Tag: v3.4.1rc1~101^2
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=156285c35f8ff856883f09394653b000331e3e33;p=python

merge 3.2
---

156285c35f8ff856883f09394653b000331e3e33
diff --cc Misc/ACKS
index 2f3a4d15be,a932074975..ec961e4bc7
--- a/Misc/ACKS
+++ b/Misc/ACKS
@@@ -1307,12 -1135,11 +1307,13 @@@ Dino Viehlan
  Kannan Vijayan
  Kurt Vile
  Norman Vine
 +Pauli Virtanen
  Frank Visser
  Johannes Vogel
 +Alex Volkov
  Martijn Vries
  Sjoerd de Vries
+ Guido Vranken
  Niki W. Waibel
  Wojtek Walczak
  Charles Waldman
diff --cc Misc/NEWS
index cd9154683d,e44219a9d7..2ca47f047b
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@@ -13,8 -10,9 +13,11 @@@ Core and Builtin
  Library
  -------
  
+ - Fix arbitrary memory access in JSONDecoder.raw_decode with a negative second
+   parameter. Bug reported by Guido Vranken.
+ 
 +- Issue #20633: Replace relative import by absolute import.
 +
  - Issue #21082: In os.makedirs, do not set the process-wide umask. Note this
    changes behavior of makedirs when exist_ok=True.
  
diff --cc Modules/_json.c
index 9166680289,5bd52cb789..ec980c93fa
--- a/Modules/_json.c
+++ b/Modules/_json.c
@@@ -964,18 -928,12 +964,21 @@@ scan_once_unicode(PyScannerObject *s, P
      Returns a new PyObject representation of the term.
      */
      PyObject *res;
 -    Py_UNICODE *str = PyUnicode_AS_UNICODE(pystr);
 -    Py_ssize_t length = PyUnicode_GET_SIZE(pystr);
 +    void *str;
 +    int kind;
 +    Py_ssize_t length;
 +
 +    if (PyUnicode_READY(pystr) == -1)
 +        return NULL;
 +
 +    str = PyUnicode_DATA(pystr);
 +    kind = PyUnicode_KIND(pystr);
 +    length = PyUnicode_GET_LENGTH(pystr);
 +
-     if (idx >= length) {
+     if (idx < 0)
+         /* Compatibility with Python version. */
+         idx += length;
+     if (idx < 0 || idx >= length) {
          PyErr_SetNone(PyExc_StopIteration);
          return NULL;
      }