Issue #18025: Fixed a segfault in io.BufferedIOBase.readinto() when raw

stream's read() returns more bytes than requested.

1 files changed, 8 insertions, 0 deletions

diff --git a/Modules/_io/bufferedio.c b/Modules/_io/bufferedio.c
index 2b39f66ccf..7f180a4592 100644
--- a/Modules/_io/bufferedio.c
+++ b/Modules/_io/bufferedio.c
@@ -69,6 +69,14 @@ bufferediobase_readinto(PyObject *self, PyObject *args)
     }
 
     len = Py_SIZE(data);
+    if (len > buf.len) {
+        PyErr_Format(PyExc_ValueError,
+                     "read() returned too much data: "
+                     "%zd bytes requested, %zd returned",
+                     buf.len, len);
+        Py_DECREF(data);
+        goto error;
+    }
     memcpy(buf.buf, PyBytes_AS_STRING(data), len);
 
     PyBuffer_Release(&buf);