Issue #18339: Negative ints keys in unpickler.memo dict no longer cause a

segfault inside the _pickle C extension.

1 files changed, 5 insertions, 0 deletions

diff --git a/Modules/_pickle.c b/Modules/_pickle.c
index a8d6684b7c..195ee5d790 100644
--- a/Modules/_pickle.c
+++ b/Modules/_pickle.c
@@ -5931,6 +5931,11 @@ Unpickler_set_memo(UnpicklerObject *self, PyObject *obj)
             idx = PyLong_AsSsize_t(key);
             if (idx == -1 && PyErr_Occurred())
                 goto error;
+            if (idx < 0) {
+                PyErr_SetString(PyExc_ValueError,
+                                "memos key must be positive integers.");
+                goto error;
+            }
             if (_Unpickler_MemoPut(self, idx, value) < 0)
                 goto error;
         }