`_pyio.BufferedReader.readinto()` can raise `ValueError` after partially filling the destination

Bug report

Bug description:

The pure Python implementation of BufferedReader.readinto() can raise ValueError for a valid writable buffer after partially modifying it.

import io
import _pyio

for module in (io, _pyio):
    reader = module.BufferedReader(module.BytesIO(b"abcd"), buffer_size=2)
    assert reader.read(1) == b"a"

    destination = bytearray(2)
    try:
        result = reader.readinto(destination)
    except ValueError as error:
        result = f"{type(error).__name__}: {error}"

    print(module.__name__, result, destination, reader.read())

Current output on main:

io 2 bytearray(b'bc') b'd'
_pyio ValueError: memoryview assignment: lvalue and rvalue have different structures bytearray(b'b\x00') b'cd'

_pyio should match io: return 2, fill the destination with b"bc", and leave b"d" unread. readinto() first partially fills the destination with data from its internal buffer, then refills that buffer with more data than fits in the remaining space. It then raises ValueError. Because the destination has already been modified and the stream has advanced when the exception is raised, the caller receives no byte count and cannot safely retry on a non-seekable stream.

_pyio.BufferedRandom.readinto() and _pyio.BufferedRWPair.readinto() are also affected because they use the same reader path.

I am working on a PR with a regression test shared by the C and pure Python implementations.

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux

Linked PRs

• gh-155075

從 _pyio.BufferedReader.readinto() 進入點開始，執行 issue 中的 reproducer，並將其與 io.BufferedReader.readinto() 比較。完成的標準是純 Python 路徑回傳 2，使用 b"bc" 填入目的地，讓 b"d" 保持未讀取狀態，並涵蓋針對 BufferedRandom 和 BufferedRWPair 所描述的共用回歸行為。