(Merge 3.3) Issue #17223: array module: Fix a crasher when converting an array

containing invalid characters (outside range [U+0000; U+10ffff]) to Unicode:
repr(array), str(array) and array.tounicode(). Patch written by Manuel Jacob.

3 files changed, 12 insertions, 0 deletions

diff --git a/Lib/test/test_array.py b/Lib/test/test_array.py
index 8b934fc..b024276 100755
--- a/Lib/test/test_array.py
+++ b/Lib/test/test_array.py
@@ -1069,6 +1069,12 @@ class UnicodeTest(StringTest, unittest.TestCase):
 
         self.assertRaises(TypeError, a.fromunicode)
 
+    def test_issue17223(self):
+        # this used to crash
+        a = array.array('u', b'\xff' * 4)
+        self.assertRaises(ValueError, a.tounicode)
+        self.assertRaises(ValueError, str, a)
+
 class NumberTest(BaseTest):
 
     def test_extslice(self):
diff --git a/Misc/NEWS b/Misc/NEWS
index 4688aff..03d4b94 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -10,6 +10,10 @@ What's New in Python 3.4.0 Alpha 1?
 Core and Builtins
 -----------------
 
+- Issue #17223: array module: Fix a crasher when converting an array containing
+  invalid characters (outside range [U+0000; U+10ffff]) to Unicode:
+  repr(array), str(array) and array.tounicode(). Patch written by Manuel Jacob.
+
 - Issue #17223: Fix PyUnicode_FromUnicode() for string of 1 character outside
   the range U+0000-U+10ffff.
 
diff --git a/Modules/arraymodule.c b/Modules/arraymodule.c
index a0e89d4..1c75989 100644
--- a/Modules/arraymodule.c
+++ b/Modules/arraymodule.c
@@ -2177,6 +2177,8 @@ array_repr(arrayobject *a)
     } else {
         v = array_tolist(a, NULL);
     }
+    if (v == NULL)
+        return NULL;
 
     s = PyUnicode_FromFormat("array('%c', %R)", (int)typecode, v);
     Py_DECREF(v);