From 49ded3ec004c49088ec26c808f9b7c931a35cf0f Mon Sep 17 00:00:00 2001
From: Guido van Rossum <guido@python.org>
Date: Fri, 19 Mar 1999 19:04:25 +0000
Subject: [PATCH] Added check for negative offset for PyBuffer_FromObject and
 check for negative size for PyBuffer_FromMemory.  Greg Stein.

---
 Objects/bufferobject.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/Objects/bufferobject.c b/Objects/bufferobject.c
index 091688d677e..86d04878b09 100644
--- a/Objects/bufferobject.c
+++ b/Objects/bufferobject.c
@@ -55,6 +55,12 @@ _PyBuffer_FromMemory(base, ptr, size, readonly)
 {
 	PyBufferObject * b;
 
+	if ( size < 0 ) {
+		PyErr_SetString(PyExc_ValueError,
+				"size must be zero or positive");
+		return NULL;
+	}
+
 	b = PyObject_NEW(PyBufferObject, &PyBuffer_Type);
 	if ( b == NULL )
 		return NULL;
@@ -83,6 +89,12 @@ _PyBuffer_FromObject(base, offset, size, proc, readonly)
 	void *p;
 	int count;
 
+	if ( offset < 0 ) {
+		PyErr_SetString(PyExc_ValueError,
+				"offset must be zero or positive");
+		return NULL;
+	}
+
 	if ( (*pb->bf_getsegcount)(base, NULL) != 1 )
 	{
 		PyErr_SetString(PyExc_TypeError, "single-segment buffer object expected");
@@ -92,7 +104,7 @@ _PyBuffer_FromObject(base, offset, size, proc, readonly)
 		return NULL;
 
 	/* apply constraints to the start/end */
-	if ( size == Py_END_OF_BUFFER )
+	if ( size == Py_END_OF_BUFFER || size < 0 )
 		size = count;
 	if ( offset > count )
 		offset = count;