gh-153578: Fix out-of-bounds write in bytearray.extend() with a reentrant __buffer__ (GH-153579)
bytearray.extend() clamped only the high bound of the append range to the current size after acquiring the argument's buffer, so a __buffer__ that shrinks the bytearray left the low bound past the high bound and ran a negative-size memmove. Clamp the low bound too, matching bytearray.__iadd__.
T
tonghuaroot (童话) committed
e675e37421357cf0319c5bca2cec533f0909d5b8
Parent: 60dff5a
Committed by GitHub <noreply@github.com>
on 8/18/2026, 12:31:52 PM