Backport r62261 from trunk:
Prevent PyString_FromStringAndSize() from passing negative sizes on to lower
level memory allocation functions. Raise a SystemError and return NULL
instead.
diff --git a/Objects/stringobject.c b/Objects/stringobject.c
index e1e287f..7cd613d 100644
--- a/Objects/stringobject.c
+++ b/Objects/stringobject.c
@@ -54,6 +54,11 @@
{
register PyStringObject *op;
assert(size >= 0);
+ if (size < 0) {
+ PyErr_SetString(PyExc_SystemError,
+ "Negative size passed to PyString_FromStringAndSize");
+ return NULL;
+ }
if (size == 0 && (op = nullstring) != NULL) {
#ifdef COUNT_ALLOCS
null_strings++;