commit c00eb73a309d5e9a4e89c3114b32eda88bd83e98
author Gregory P. Smith <greg@mad-scientist.com> Wed Apr 09 23:16:37 2008 +0000
committer Gregory P. Smith <greg@mad-scientist.com> Wed Apr 09 23:16:37 2008 +0000
tree faec1107bc64ecfc8f230d9f294a02503a530e45
parent f10832005599cb78b20ccbae63adf8a9450ba2bf

Raise SystemError when size < 0 is passed into PyString_FromStringAndSize,
PyBytes_FromStringAndSize or PyUnicode_FromStringAndSize.  [issue2587]

Objects/bytesobject.c

diff --git a/Objects/bytesobject.c b/Objects/bytesobject.c
index 23de37e..af7a1b1 100644
--- a/Objects/bytesobject.c
+++ b/Objects/bytesobject.c
@@ -161,6 +161,11 @@
     Py_ssize_t alloc;
 
     assert(size >= 0);
+    if (size < 0) {
+        PyErr_SetString(PyExc_SystemError,
+            "Negative size passed to PyBytes_FromStringAndSize");
+        return NULL;
+    }
 
     new = PyObject_New(PyBytesObject, &PyBytes_Type);
     if (new == NULL)