gh-156180: Reject a negative len2 in zlib.{adler32,crc32}_combine() (GH-156181)

(cherry picked from commit b062727097e997bcb900e11503d3248daac903da)

Co-authored-by: Stan Ulbrych <stan@python.org>
Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

Author: 2 people

.github/CODEOWNERS

@@ -624,6 +624,12 @@ Lib/test/test_unittest/testmock/ @cjw296
 # Weakref
 **/*weakref*                  @kumaraditya303
 
+# Zlib
+Doc/library/zlib.rst          @StanFromIreland
+Lib/compression/zlib.py       @StanFromIreland
+Lib/test/test_zlib.py         @StanFromIreland
+Modules/_zlibmodule.c         @StanFromIreland
+
 # Zipfile.Path
 Lib/test/test_zipfile/_path/  @jaraco
 Lib/zipfile/_path/            @jaraco

Lib/test/test_zlib.py

@@ -182,6 +182,9 @@ def test_combine_no_iv_invalid_length(self):
             self.assertNotEqual(invalid_res, checksum)
 
         self.assertRaises(TypeError, self.combine, 0, 0, "len")
+        self.assertRaises(ValueError, self.combine, 0, 0, -1)
+        self.assertRaises(OverflowError, self.combine, 0, 0, 2**1000)
+        self.assertRaises(OverflowError, self.combine, 0, 0, -2**1000)
 
     def test_combine_with_iv(self):
         for _ in range(self.N):

Misc/NEWS.d/next/Library/2026-08-21-14-30-00.gh-issue-156180.Qz3Lv8.rst

@@ -0,0 +1,3 @@
+:func:`zlib.adler32_combine` and :func:`zlib.crc32_combine` now raise
+:exc:`ValueError` if the *len2* argument is negative, instead of returning
+rubbish or hanging indefinitely, respectively.

Modules/zlibmodule.c

@@ -1948,7 +1948,10 @@ zlib_adler32_combine_impl(PyObject *module, unsigned int adler1,
 #else
     z_off_t len = convert_to_z_off_t(len2);
 #endif
-    if (PyErr_Occurred()) {
+    if (len < 0) {
+        if (!PyErr_Occurred()) {
+            PyErr_SetString(PyExc_ValueError, "len2 must be non-negative");
+        }
         return (unsigned int)-1;
     }
     return adler32_combine(adler1, adler2, len);
@@ -2033,7 +2036,10 @@ zlib_crc32_combine_impl(PyObject *module, unsigned int crc1,
 #else
     z_off_t len = convert_to_z_off_t(len2);
 #endif
-    if (PyErr_Occurred()) {
+    if (len < 0) {
+        if (!PyErr_Occurred()) {
+            PyErr_SetString(PyExc_ValueError, "len2 must be non-negative");
+        }
         return (unsigned int)-1;
     }
     return crc32_combine(crc1, crc2, len);