@@ -614,6 +614,27 @@ def test_slice(self):
614614 with self .assertRaises (ValueError ):
615615 marshal .dumps (obj , version )
616616
617+ def test_slice_ref_reserve_failure (self ):
618+ # Test for the fix: if (idx < 0) { break; }
619+ # This tests the case where r_ref_reserve fails when processing TYPE_SLICE with FLAG_REF
620+ # We simulate a scenario where the reference list is too large
621+
622+ # Create malformed marshal data: TYPE_SLICE with FLAG_REF but invalid reference handling
623+ # This should trigger the r_ref_reserve failure path and be handled gracefully
624+ malformed_data = b'\xba ' # TYPE_SLICE | FLAG_REF (0x3a | 0x80)
625+ malformed_data += b'N' # None for start
626+ malformed_data += b'N' # None for stop
627+ malformed_data += b'N' # None for step
628+
629+ # This should raise an exception rather than crash
630+ with self .assertRaises ((ValueError , EOFError )):
631+ marshal .loads (malformed_data )
632+
633+ # Test truncated data that would also trigger the error path
634+ truncated_data = b'\xba ' + b'N' # TYPE_SLICE | FLAG_REF + only one component
635+ with self .assertRaises ((ValueError , EOFError )):
636+ marshal .loads (truncated_data )
637+
617638@support .cpython_only
618639@unittest .skipUnless (_testcapi , 'requires _testcapi' )
619640class CAPI_TestCase (unittest .TestCase , HelperMixin ):
0 commit comments