Issue #8195: Fix a crash in sqlite Connection.create_collation() if the

collation name contains a surrogate character.

1 files changed, 12 insertions, 5 deletions

diff --git a/Modules/_sqlite/connection.c b/Modules/_sqlite/connection.c
index d916c34..88d6b40 100644
--- a/Modules/_sqlite/connection.c
+++ b/Modules/_sqlite/connection.c
@@ -1374,7 +1374,9 @@ pysqlite_connection_create_collation(pysqlite_Connection* self, PyObject* args)
     PyObject* uppercase_name = 0;
     PyObject* name;
     PyObject* retval;
-    char* chk;
+    Py_UNICODE* chk;
+    Py_ssize_t i, len;
+    char *uppercase_name_str;
     int rc;
 
     if (!pysqlite_check_thread(self) || !pysqlite_check_connection(self)) {
@@ -1390,19 +1392,24 @@ pysqlite_connection_create_collation(pysqlite_Connection* self, PyObject* args)
         goto finally;
     }
 
-    chk = _PyUnicode_AsString(uppercase_name);
-    while (*chk) {
+    len = PyUnicode_GET_SIZE(uppercase_name);
+    chk = PyUnicode_AS_UNICODE(uppercase_name);
+    for (i=0; i<len; i++, chk++) {
         if ((*chk >= '0' && *chk <= '9')
          || (*chk >= 'A' && *chk <= 'Z')
          || (*chk == '_'))
         {
-            chk++;
+            continue;
         } else {
             PyErr_SetString(pysqlite_ProgrammingError, "invalid character in collation name");
             goto finally;
         }
     }
 
+    uppercase_name_str = _PyUnicode_AsString(uppercase_name);
+    if (!uppercase_name_str)
+        goto finally;
+
     if (callable != Py_None && !PyCallable_Check(callable)) {
         PyErr_SetString(PyExc_TypeError, "parameter must be callable");
         goto finally;
@@ -1417,7 +1424,7 @@ pysqlite_connection_create_collation(pysqlite_Connection* self, PyObject* args)
     }
 
     rc = sqlite3_create_collation(self->db,
-                                  _PyUnicode_AsString(uppercase_name),
+                                  uppercase_name_str,
                                   SQLITE_UTF8,
                                   (callable != Py_None) ? callable : NULL,
                                   (callable != Py_None) ? pysqlite_collation_callback : NULL);