Issue #12847: Fix a crash with negative PUT and LONG_BINPUT arguments in
the C pickle implementation.
diff --git a/Modules/_pickle.c b/Modules/_pickle.c
index d7d81cd..20ee302 100644
--- a/Modules/_pickle.c
+++ b/Modules/_pickle.c
@@ -4853,8 +4853,12 @@
return -1;
idx = PyLong_AsSsize_t(key);
Py_DECREF(key);
- if (idx == -1 && PyErr_Occurred())
+ if (idx < 0) {
+ if (!PyErr_Occurred())
+ PyErr_SetString(PyExc_ValueError,
+ "negative PUT argument");
return -1;
+ }
return _Unpickler_MemoPut(self, idx, value);
}
@@ -4893,6 +4897,11 @@
value = self->stack->data[Py_SIZE(self->stack) - 1];
idx = calc_binsize(s, 4);
+ if (idx < 0) {
+ PyErr_SetString(PyExc_ValueError,
+ "negative LONG_BINPUT argument");
+ return -1;
+ }
return _Unpickler_MemoPut(self, idx, value);
}