Issue #6922: Fix an infinite loop when trying to decode an invalid

UTF-32 stream with a non-raising error handler like "replace" or "ignore".

3 files changed, 16 insertions, 1 deletions

diff --git a/Lib/test/test_codecs.py b/Lib/test/test_codecs.py
index 06cab1c..1893311 100644
--- a/Lib/test/test_codecs.py
+++ b/Lib/test/test_codecs.py
@@ -305,6 +305,12 @@ class UTF32Test(ReadTest):
             ]
         )
 
+    def test_handlers(self):
+        self.assertEqual((u'\ufffd', 1),
+                         codecs.utf_32_decode('\x01', 'replace', True))
+        self.assertEqual((u'', 1),
+                         codecs.utf_32_decode('\x01', 'ignore', True))
+
     def test_errors(self):
         self.assertRaises(UnicodeDecodeError, codecs.utf_32_decode,
                           "\xff", "strict", True)
@@ -422,6 +428,12 @@ class UTF16Test(ReadTest):
             ]
         )
 
+    def test_handlers(self):
+        self.assertEqual((u'\ufffd', 1),
+                         codecs.utf_16_decode('\x01', 'replace', True))
+        self.assertEqual((u'', 1),
+                         codecs.utf_16_decode('\x01', 'ignore', True))
+
     def test_errors(self):
         self.assertRaises(UnicodeDecodeError, codecs.utf_16_decode, "\xff", "strict", True)
 
diff --git a/Misc/NEWS b/Misc/NEWS
index 7796957..dc37a37 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -12,6 +12,9 @@ What's New in Python 2.7 alpha 1
 Core and Builtins
 -----------------
 
+- Issue #6922: Fix an infinite loop when trying to decode an invalid
+  UTF-32 stream with a non-raising error handler like "replace" or "ignore".
+
 - Issue #6713: Improve performance of integer -> string conversions.
 
 - Issue #1590864: Fix potential deadlock when mixing threads and fork().
diff --git a/Objects/unicodeobject.c b/Objects/unicodeobject.c
index c4b4902..6164510 100644
--- a/Objects/unicodeobject.c
+++ b/Objects/unicodeobject.c
@@ -2321,7 +2321,7 @@ PyUnicode_DecodeUTF32Stateful(const char *s,
         if (unicode_decode_call_errorhandler(
                 errors, &errorHandler,
                 "utf32", errmsg,
-                starts, size, &startinpos, &endinpos, &exc, &s,
+                starts, size, &startinpos, &endinpos, &exc, (const char **)&q,
                 &unicode, &outpos, &p))
             goto onError;
     }