diff options
| author | Serhiy Storchaka <storchaka@gmail.com> | 2015-01-25 23:22:54 (GMT) |
|---|---|---|
| committer | Serhiy Storchaka <storchaka@gmail.com> | 2015-01-25 23:22:54 (GMT) |
| commit | 7e4b9057b3180ed1b7b26dc8f9a2d2162d4e83b0 (patch) | |
| tree | 8e913aa3c38cf89020ce5facfbb2e35da51a8e25 /Objects/unicodeobject.c | |
| parent | 1923b627b50d26f37065e7ad51fc7eeccd7ac92f (diff) | |
| download | cpython-7e4b9057b3180ed1b7b26dc8f9a2d2162d4e83b0.zip cpython-7e4b9057b3180ed1b7b26dc8f9a2d2162d4e83b0.tar.gz cpython-7e4b9057b3180ed1b7b26dc8f9a2d2162d4e83b0.tar.bz2 | |
Issue #23321: Fixed a crash in str.decode() when error handler returned
replacment string longer than mailformed input data.
Diffstat (limited to 'Objects/unicodeobject.c')
| -rw-r--r-- | Objects/unicodeobject.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/Objects/unicodeobject.c b/Objects/unicodeobject.c index 216cd6a..84ab6a1 100644 --- a/Objects/unicodeobject.c +++ b/Objects/unicodeobject.c @@ -4190,9 +4190,13 @@ unicode_decode_call_errorhandler_writer( if (PyUnicode_READY(repunicode) < 0) goto onError; replen = PyUnicode_GET_LENGTH(repunicode); - writer->min_length += replen; - if (replen > 1) + if (replen > 1) { + writer->min_length += replen - 1; writer->overallocate = 1; + if (_PyUnicodeWriter_Prepare(writer, writer->min_length, + PyUnicode_MAX_CHAR_VALUE(repunicode)) == -1) + goto onError; + } if (_PyUnicodeWriter_WriteStr(writer, repunicode) == -1) goto onError; |