# HG changeset patch

# User Benjamin Peterson <benjamin@python.org>

# Date 1397441438 14400

# Node ID 50c07ed1743da9cd4540d83de0c30bd17aeb41b0

# Parent  218e28a935ab4494d05215c243e2129625a71893

in scan_once, prevent the reading of arbitrary memory when passed a negative index

Bug reported by Guido Vranken.

diff --git a/Lib/json/tests/test_decode.py b/Lib/json/tests/test_decode.py

--- a/Lib/json/tests/test_decode.py

+++ b/Lib/json/tests/test_decode.py

@@ -60,5 +60,10 @@ class TestDecode(object):

         msg = 'escape'

         self.assertRaisesRegexp(ValueError, msg, self.loads, s)

+    def test_negative_index(self):

+        d = self.json.JSONDecoder()

+        self.assertRaises(ValueError, d.raw_decode, 'a'*42, -50000)

+        self.assertRaises(ValueError, d.raw_decode, u'a'*42, -50000)

+

 class TestPyDecode(TestDecode, PyTest): pass

 class TestCDecode(TestDecode, CTest): pass

diff --git a/Modules/_json.c b/Modules/_json.c

--- a/Modules/_json.c

+++ b/Modules/_json.c

@@ -1468,7 +1468,10 @@ scan_once_str(PyScannerObject *s, PyObje

     PyObject *res;

     char *str = PyString_AS_STRING(pystr);

     Py_ssize_t length = PyString_GET_SIZE(pystr);

-    if (idx >= length) {

+    if (idx < 0)

+        /* Compatibility with the Python version. */

+        idx += length;

+    if (idx < 0 || idx >= length) {

         PyErr_SetNone(PyExc_StopIteration);

         return NULL;

     }

@@ -1555,7 +1558,10 @@ scan_once_unicode(PyScannerObject *s, Py

     PyObject *res;

     Py_UNICODE *str = PyUnicode_AS_UNICODE(pystr);

     Py_ssize_t length = PyUnicode_GET_SIZE(pystr);

-    if (idx >= length) {

+    if (idx < 0)

+        /* Compatibility with Python version. */

+        idx += length;

+    if (idx < 0 || idx >= length) {

         PyErr_SetNone(PyExc_StopIteration);

         return NULL;

     }