Fix buffer offset calculation (need to compute it before changing

'base').  Fixes SF bug #1033720.  Move offset sanity checking to
buffer_from_memory().

Objects/bufferobject.c

@@ -66,6 +66,11 @@ buffer_from_memory(PyObject *base, int size, int offset, void *ptr,
 				"size must be zero or positive");
 		return NULL;
 	}
+	if (offset < 0) {
+		PyErr_SetString(PyExc_ValueError,
+				"offset must be zero or positive");
+		return NULL;
+	}
 
 	b = PyObject_NEW(PyBufferObject, &PyBuffer_Type);
 	if ( b == NULL )
@@ -85,20 +90,11 @@ buffer_from_memory(PyObject *base, int size, int offset, void *ptr,
 static PyObject *
 buffer_from_object(PyObject *base, int size, int offset, int readonly)
 {
-	if ( offset < 0 ) {
-		PyErr_SetString(PyExc_ValueError,
-				"offset must be zero or positive");
-		return NULL;
-	}
-
-	/* if the base object is another buffer, then try to refer to the
-	 * base object.
-	 */
 	if ( PyBuffer_Check(base) && (((PyBufferObject *)base)->b_base) ) {
+		/* another buffer, refer to the base object */
+		offset += ((PyBufferObject *)base)->b_offset;
 		base = ((PyBufferObject *)base)->b_base;
-		offset = ((PyBufferObject *)base)->b_offset + offset;
 	}
-	
 	return buffer_from_memory(base, size, offset, NULL, readonly);
 }