[3.14] pythongh-136053: Check error for TYPE_SLICE in marshal.c (pythonGH-136054) (pythonGH-136092)

Fix a possible crash when deserializing a large marshal data
(at least several GiBs) containing a slice.
(cherry picked from commit 30ba03e)

Co-authored-by: Akshat Gupta <[email protected]>

Author: miss-islington

Misc/NEWS.d/next/Security/2025-06-27-21-23-19.gh-issue-136053.QZxcee.rst

@@ -0,0 +1 @@
+:mod:`marshal`: fix a possible crash when deserializing :class:`slice` objects.

Python/marshal.c

@@ -1656,6 +1656,9 @@ r_object(RFILE *p)
     case TYPE_SLICE:
     {
         Py_ssize_t idx = r_ref_reserve(flag, p);
+        if (idx < 0) {
+            break;
+        }
         PyObject *stop = NULL;
         PyObject *step = NULL;
         PyObject *start = r_object(p);