[3.14] gh-160179: Leave bytearray empty when __init__() fails midway (GH-160180) (#160204)

The list/tuple fast path and the buffer path resized the object before
filling it and did not undo the resize on error, leaving stale bytes.

(cherry picked from commit 5a63d35)

Author: gpshead

Lib/test/test_bytes.py

@@ -2151,6 +2151,16 @@ def __len__(self):
 
         self.assertRaises(BufferError, ba.hex, S(b':'))
 
+    def test_reinit_error(self):
+        # A failed __init__() must not leave uninitialized bytes in the
+        # object: it must be empty afterwards.
+        for source in ([256] * 100, (-1,) * 100, [0] * 50 + [1000],
+                       (1, 2, 1 << 100)):
+            with self.subTest(source=source):
+                a = bytearray(b"abc")
+                self.assertRaises(ValueError, a.__init__, source)
+                self.assertEqual(a, b"")
+
 
 class AssortedBytesTest(unittest.TestCase):
     #

Misc/NEWS.d/next/Core_and_Builtins/2026-10-22-00-30-02.gh-issue-160179.dQ2e7m.rst

@@ -0,0 +1,3 @@
+Fix :meth:`!bytearray.__init__` leaving uninitialized memory in the object
+when it fails on a :class:`list` or :class:`tuple` containing an integer not
+in ``range(256)``. The object is now empty after the failed call.

Objects/bytearrayobject.c

@@ -1000,7 +1000,11 @@ bytearray___init___impl(PyByteArrayObject *self, PyObject *arg,
         if (PyByteArray_Resize((PyObject *)self, size) < 0) goto fail;
         if (PyBuffer_ToContiguous(PyByteArray_AS_STRING(self),
             &view, size, 'C') < 0)
+        {
+            /* Don't expose the uninitialized bytes: reset to empty */
+            (void)PyByteArray_Resize((PyObject *)self, 0);
             goto fail;
+        }
         PyBuffer_Release(&view);
         return 0;
     fail:
@@ -1028,6 +1032,8 @@ bytearray___init___impl(PyByteArrayObject *self, PyObject *arg,
             }
             int rc = _getbytevalue(items[i], &value);
             if (!rc) {
+                /* Don't expose the uninitialized bytes: reset to empty */
+                (void)PyByteArray_Resize((PyObject *)self, 0);
                 return -1;
             }
             s[i] = value;