Raise SystemError when size < 0 is passed into PyString_FromStringAndSize,
PyBytes_FromStringAndSize or PyUnicode_FromStringAndSize. [issue2587]
diff --git a/Objects/stringobject.c b/Objects/stringobject.c
index 4c36e4b..f4b4264 100644
--- a/Objects/stringobject.c
+++ b/Objects/stringobject.c
@@ -56,6 +56,11 @@
{
register PyStringObject *op;
assert(size >= 0);
+ if (size < 0) {
+ PyErr_SetString(PyExc_SystemError,
+ "Negative size passed to PyString_FromStringAndSize");
+ return NULL;
+ }
if (size == 0 && (op = nullstring) != NULL) {
#ifdef COUNT_ALLOCS
null_strings++;