Issue #18408: PyObject_GC_NewVar() now raises SystemError exception if nitems
is negative
diff --git a/Modules/gcmodule.c b/Modules/gcmodule.c
index 51c80b2..d96d2c7 100644
--- a/Modules/gcmodule.c
+++ b/Modules/gcmodule.c
@@ -1689,8 +1689,15 @@
PyVarObject *
_PyObject_GC_NewVar(PyTypeObject *tp, Py_ssize_t nitems)
{
- const size_t size = _PyObject_VAR_SIZE(tp, nitems);
- PyVarObject *op = (PyVarObject *) _PyObject_GC_Malloc(size);
+ size_t size;
+ PyVarObject *op;
+
+ if (nitems < 0) {
+ PyErr_BadInternalCall();
+ return NULL;
+ }
+ size = _PyObject_VAR_SIZE(tp, nitems);
+ op = (PyVarObject *) _PyObject_GC_Malloc(size);
if (op != NULL)
op = PyObject_INIT_VAR(op, tp, nitems);
return op;