diff options
| author | Benjamin Peterson <benjamin@python.org> | 2015-03-02 16:17:05 (GMT) |
|---|---|---|
| committer | Benjamin Peterson <benjamin@python.org> | 2015-03-02 16:17:05 (GMT) |
| commit | b027c6cae0bf591d62348f555116f28e0c081880 (patch) | |
| tree | eb52ce8e7dca629a43dad47ea031a016c8baa70e /Modules/unicodedata.c | |
| parent | b198ad9a3c93923f88065811f97e75c9f8abf39a (diff) | |
| download | cpython-b027c6cae0bf591d62348f555116f28e0c081880.zip cpython-b027c6cae0bf591d62348f555116f28e0c081880.tar.gz cpython-b027c6cae0bf591d62348f555116f28e0c081880.tar.bz2 | |
fix possible overflow bugs in unicodedata (closes #23367)
Diffstat (limited to 'Modules/unicodedata.c')
| -rw-r--r-- | Modules/unicodedata.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/Modules/unicodedata.c b/Modules/unicodedata.c index 6f9c7e8..6b01fc76 100644 --- a/Modules/unicodedata.c +++ b/Modules/unicodedata.c @@ -506,8 +506,15 @@ nfd_nfkd(PyObject *self, PyObject *input, int k) stackptr = 0; isize = PyUnicode_GET_SIZE(input); + space = isize; /* Overallocate at most 10 characters. */ - space = (isize > 10 ? 10 : isize) + isize; + if (space > 10) { + if (space <= PY_SSIZE_T_MAX - 10) + space += 10; + } + else { + space *= 2; + } result = PyUnicode_FromUnicode(NULL, space); if (!result) return NULL; |