Issue #12847: Fix a crash with negative PUT and LONG_BINPUT arguments in
the C pickle implementation.
diff --git a/Lib/pickle.py b/Lib/pickle.py
index aca8fd1..32ae02b 100644
--- a/Lib/pickle.py
+++ b/Lib/pickle.py
@@ -1156,16 +1156,22 @@
def load_put(self):
i = int(self.readline()[:-1])
+ if i < 0:
+ raise ValueError("negative PUT argument")
self.memo[i] = self.stack[-1]
dispatch[PUT[0]] = load_put
def load_binput(self):
i = self.read(1)[0]
+ if i < 0:
+ raise ValueError("negative BINPUT argument")
self.memo[i] = self.stack[-1]
dispatch[BINPUT[0]] = load_binput
def load_long_binput(self):
i = mloads(b'i' + self.read(4))
+ if i < 0:
+ raise ValueError("negative LONG_BINPUT argument")
self.memo[i] = self.stack[-1]
dispatch[LONG_BINPUT[0]] = load_long_binput