This patch comes from upstream: http://bugs.python.org/issue21831

--- a/Objects/bufferobject.c

+++ b/Objects/bufferobject.c

@@ -88,7 +88,7 @@ get_buf(PyBufferObject *self, void **ptr

*size = count;

else

*size = self->b_size;

- if (offset + *size > count)

+ if (*size > count - offset)

*size = count - offset;

}

return 1;