Fix negative lengths when the buffer is not none for py27.

src/gevent/_ssl3.py

@@ -282,6 +282,8 @@ class SSLSocket(socket):
                 raise ValueError("Read on closed or unwrapped SSL socket.")
             if len == 0:
                 return b'' if buffer is None else 0
+            # Negative lengths are handled natively when the buffer is None
+            # to raise a ValueError
             try:
                 if buffer is not None:
                     return self._sslobj.read(len, buffer)

src/gevent/_sslgte279.py

@@ -305,7 +305,7 @@ class SSLSocket(socket):
                 raise ValueError("Read on closed or unwrapped SSL socket.")
             if len == 0:
                 return b'' if buffer is None else 0
-            if len < 0:
+            if len < 0 and buffer is None:
                 # This is handled natively in python 2.7.12+
                 raise ValueError("Negative read length")
             try: