Reject negative lengths in Unpacker.read_bytes

msgpack/_unpacker.pyx

@@ -535,6 +535,8 @@ cdef class Unpacker:
             raise RuntimeError("Unpacker.read_bytes() cannot be called while unpacking is in progress")
         if self.ctx.execute != NULL:
             raise ValueError("Cannot switch unpacking methods while an object is incomplete")
+        if nbytes < 0:
+            raise ValueError("nbytes must be non-negative")
         nread = min(self.buf_tail - self.buf_head, nbytes)
         ret = PyBytes_FromStringAndSize(self.buf + self.buf_head, nread)
         self.buf_head += nread

msgpack/fallback.py

@@ -354,6 +354,8 @@ def _get_extradata(self):
         return self._buffer[self._buff_i :]
 
     def read_bytes(self, n):
+        if n < 0:
+            raise ValueError("nbytes must be non-negative")
         ret = self._read(n, raise_outofdata=False)
         self._consume()
         # The C extension returns bytes. A bytearray slice cannot be a dict key.

test/test_unpack.py

@@ -99,6 +99,24 @@ def test_unpacker_tell_read_bytes():
         assert unpacker.read_bytes(n) == raw
 
 
+@mark.parametrize("from_file", [False, True])
+@mark.parametrize("nbytes", [-1, -(2**31)])
+def test_unpacker_read_bytes_negative(from_file, nbytes):
+    packed = packb([1, 2])
+    unpacker = Unpacker(BytesIO(packed)) if from_file else Unpacker()
+    if not from_file:
+        unpacker.feed(packed)
+    assert unpacker.read_array_header() == 2
+
+    with raises(ValueError, match="non-negative"):
+        unpacker.read_bytes(nbytes)
+
+    assert unpacker.tell() == 1
+    assert unpacker.read_bytes(0) == b""
+    assert unpacker.read_bytes(1) == b"\x01"
+    assert unpacker.unpack() == 2
+
+
 @mark.skipif(
     Unpacker.__module__ == "msgpack.fallback",
     reason="specific to C extension reinit leak",