Patch #1093585: raise a ValueError for negative history items in

remove_history and replace_history.

2 files changed, 17 insertions, 1 deletions

diff --git a/Misc/NEWS b/Misc/NEWS
index 9106f80..055c32b 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -25,6 +25,13 @@ Core and builtins
   is provided.
 
 
+Extension Modules
+-----------------
+
+- Patch #1093585: raise a ValueError for negative history items in readline.
+  {remove_history,replace_history}
+
+
 Library
 -------
 
@@ -59,7 +66,6 @@ Library
 - Bug #1083110: ``zlib.decompress.flush()`` would segfault if called immediately
   after creating the object, without any intervening ``.decompress()`` calls.
 
-
 Build
 -----
 
diff --git a/Modules/readline.c b/Modules/readline.c
index 9d5a6be..706eb7a 100644
--- a/Modules/readline.c
+++ b/Modules/readline.c
@@ -303,6 +303,11 @@ py_remove_history(PyObject *self, PyObject *args)
 
         if (!PyArg_ParseTuple(args, "i:remove_history", &entry_number))
                 return NULL;
+        if (entry_number < 0) {
+                PyErr_SetString(PyExc_ValueError,
+                                "History index cannot be negative");
+                return NULL;
+        }
         entry = remove_history(entry_number);
         if (!entry) {
                 PyErr_Format(PyExc_ValueError,
@@ -335,6 +340,11 @@ py_replace_history(PyObject *self, PyObject *args)
         if (!PyArg_ParseTuple(args, "is:replace_history", &entry_number, &line)) {
                 return NULL;
         }
+        if (entry_number < 0) {
+                PyErr_SetString(PyExc_ValueError,
+                                "History index cannot be negative");
+                return NULL;
+        }
         old_entry = replace_history_entry(entry_number, line, (void *)NULL);
         if (!old_entry) {
                 PyErr_Format(PyExc_ValueError,