Reject a negative len2 in zlib.{adler32,crc32}_combine()

Author: StanFromIreland

.github/CODEOWNERS

@@ -620,6 +620,12 @@ Lib/test/test_unittest/testmock/ @cjw296
 # Weakref
 **/*weakref*                  @kumaraditya303
 
+# Zlib
+Doc/library/zlib.rst          @StanFromIreland
+Lib/compression/zlib.py       @StanFromIreland
+Lib/test/test_zlib.py         @StanFromIreland
+Modules/_zlibmodule.c         @StanFromIreland
+
 # Zipfile.Path
 Lib/test/test_zipfile/_path/  @jaraco
 Lib/zipfile/_path/            @jaraco

Lib/test/test_zlib.py

@@ -182,6 +182,8 @@ def test_combine_no_iv_invalid_length(self):
             self.assertNotEqual(invalid_res, checksum)
 
         self.assertRaises(TypeError, self.combine, 0, 0, "len")
+        self.assertRaises(ValueError, self.combine, 0, 0, -1)
+        self.assertRaises(ValueError, self.combine, 0, 0, -2**32)
 
     def test_combine_with_iv(self):
         for _ in range(self.N):

Misc/NEWS.d/next/Library/2026-08-21-14-30-00.gh-issue-156180.Qz3Lv8.rst

@@ -0,0 +1,3 @@
+:func:`zlib.crc32_combine` and :func:`zlib.adler32_combine` now raise
+:exc:`ValueError` if the *len2* argument is negative, instead of hanging
+indefinitely or returning rubbish, respectively.

Modules/zlibmodule.c

@@ -1951,6 +1951,10 @@ zlib_adler32_combine_impl(PyObject *module, unsigned int adler1,
     if (PyErr_Occurred()) {
         return (unsigned int)-1;
     }
+    if (len < 0) {
+        PyErr_SetString(PyExc_ValueError, "len2 must be non-negative");
+        return (unsigned int)-1;
+    }
     return adler32_combine(adler1, adler2, len);
 }
 
@@ -2036,6 +2040,10 @@ zlib_crc32_combine_impl(PyObject *module, unsigned int crc1,
     if (PyErr_Occurred()) {
         return (unsigned int)-1;
     }
+    if (len < 0) {
+        PyErr_SetString(PyExc_ValueError, "len2 must be non-negative");
+        return (unsigned int)-1;
+    }
     return crc32_combine(crc1, crc2, len);
 }