PyUnicode_CopyCharacters() fails if 'to' has more than 1 reference

2 files changed, 10 insertions, 1 deletions

diff --git a/Include/unicodeobject.h b/Include/unicodeobject.h
index 0b93276..99f54c3 100644
--- a/Include/unicodeobject.h
+++ b/Include/unicodeobject.h
@@ -522,7 +522,8 @@ PyAPI_FUNC(int) _PyUnicode_Ready(
    character conversion when necessary and falls back to memcpy if possible.
 
    Fail if 'to' is smaller than how_many or smaller than len(from)-from_start,
-   or if kind(from[from_start:from_start+how_many]) > kind(to).
+   or if kind(from[from_start:from_start+how_many]) > kind(to), or if to has
+   more than 1 reference.
 
    Return the number of written character, or return -1 and raise an exception
    on error.
diff --git a/Objects/unicodeobject.c b/Objects/unicodeobject.c
index ae2dbf5..af05f4c 100644
--- a/Objects/unicodeobject.c
+++ b/Objects/unicodeobject.c
@@ -631,6 +631,14 @@ PyUnicode_CopyCharacters(PyObject *to, Py_ssize_t to_start,
                      how_many, to_start, PyUnicode_GET_LENGTH(to));
         return -1;
     }
+    if (how_many == 0)
+        return 0;
+
+    if (Py_REFCNT(to) != 1) {
+        PyErr_SetString(PyExc_ValueError,
+                        "Cannot modify a string having more than 1 reference");
+        return -1;
+    }
 
     from_kind = PyUnicode_KIND(from);
     to_kind = PyUnicode_KIND(to);