bpo-36495: Fix two out-of-bounds array reads

[bradlarsen]

https://bugs.python.org/issue36495

https://bugs.python.org/issue36495

[the-knights-who-say-ni]

Hello, and thanks for your contribution!

I'm a bot set up to make sure that the project can legally accept your contribution by verifying you have signed the PSF contributor agreement (CLA).

Unfortunately we couldn't find an account corresponding to your GitHub username on bugs.python.org (b.p.o) to verify you have signed the CLA (this might be simply due to a missing "GitHub Name" entry in your b.p.o account settings). This is necessary for legal reasons before we can look at your contribution. Please follow the steps outlined in the CPython devguide to rectify this issue.

You can check yourself to see if the CLA has been received.

Thanks again for your contribution, we look forward to reviewing it!

[serhiy-storchaka]

I am not sure this fix needs a NEWS entry, especially in the Security section. The bug was introduces at the alpha stage, nobody should use it in production.

[bradlarsen]

I agree; I was originally going to leave that blank, but bedevere-bot said one was needed (or I didn't understand how to skip that check).

[bradlarsen]

Should I revert the commit that adds the NEWS entry?

[bradlarsen]

It looks like that Azure Pipelines Ubuntu job has been usually failing for a while now?

[tirkarthi]

It looks like that Azure Pipelines Ubuntu job has been usually failing for a while now?

It's a known issue tracked at #12625

[gvanrossum]

Thanks for the contribution! Great research. Let's fix these, but let's get rid of the NEWS item.

[bradlarsen]

Great! I've reverted the NEWS item commit, so I think this PR is ready now.