gh-140607: Validate returned byte count in RawIOBase.read

Lib/_pyio.py

@@ -617,6 +617,8 @@ def read(self, size=-1):
         n = self.readinto(b)
         if n is None:
             return None
+        if n < 0 or n > len(b):
+            raise ValueError(f"readinto returned '{n}' outside buffer size '{len(b)}'")
         del b[n:]
         return bytes(b)
 

Lib/test/test_io/test_general.py

@@ -592,6 +592,23 @@ def test_RawIOBase_read(self):
         self.assertEqual(rawio.read(2), None)
         self.assertEqual(rawio.read(2), b"")
 
+    def test_RawIOBase_read_bounds_checking(self):
+        # Make sure a `.readinto` call which returns a value oustside
+        # (0, len(buffer)) raises.
+        class Misbehaved(io.RawIOBase):
+            def __init__(self, readinto_return) -> None:
+                self._readinto_return = readinto_return
+            def readinto(self, b):
+                return self._readinto_return
+
+        with self.assertRaises(ValueError) as cm:
+            Misbehaved(2).read(1)
+        self.assertEqual(str(cm.exception), "readinto returned '2' oustside buffer size '1'")
+        self.assertRaises(ValueError, Misbehaved(2147483647).read)
+        self.assertRaises(ValueError, Misbehaved(sys.maxsize).read)
+        self.assertRaises(ValueError, Misbehaved(-1).read)
+        self.assertRaises(ValueError, Misbehaved(-1000).read)
+
     def test_types_have_dict(self):
         test = (
             self.IOBase(),

Misc/NEWS.d/next/Library/2025-10-25-21-04-00.gh-issue-104607.oOZGxS.rst

@@ -0,0 +1,2 @@
+Inside :meth:`io.RawIOBase.read` validate that the count of bytes returned by
+:meth:`io.RawIOBase.readinto` is reasonable (inside the provided buffer).

Modules/_io/iobase.c

@@ -939,14 +939,21 @@
         return res;
     }
 
-    n = PyNumber_AsSsize_t(res, PyExc_ValueError);
+    Py_ssize_t bytes_filled = PyNumber_AsSsize_t(res, PyExc_ValueError);
     Py_DECREF(res);
-    if (n == -1 && PyErr_Occurred()) {
+    if (readinto_len == -1 && PyErr_Occurred()) {
         Py_DECREF(b);
         return NULL;
     }
+    if (bytes_filled < 0 || bytes_filled > n) {
+        Py_DECREF(b);
+        PyErr_Format(PyExc_ValueError,
+                        "readinto returned '%zd' oustside buffer size '%zd'",
+                        bytes_filled, n);
+        return NULL;
+    }
 
-    res = PyBytes_FromStringAndSize(PyByteArray_AsString(b), n);
+    res = PyBytes_FromStringAndSize(PyByteArray_AsString(b), bytes_filled);
     Py_DECREF(b);
     return res;
 }