diff options
| -rw-r--r-- | Lib/test/test_unicode.py | 5 | ||||
| -rw-r--r-- | Misc/NEWS | 3 | ||||
| -rw-r--r-- | Objects/unicodeobject.c | 5 |
3 files changed, 13 insertions, 0 deletions
diff --git a/Lib/test/test_unicode.py b/Lib/test/test_unicode.py index 9ae31d1..a72a0cc 100644 --- a/Lib/test/test_unicode.py +++ b/Lib/test/test_unicode.py @@ -672,6 +672,11 @@ class UnicodeTest(string_tests.CommonTest, self.assertEqual('x'.center(4, '\U0010FFFF'), '\U0010FFFFx\U0010FFFF\U0010FFFF') + @unittest.skipUnless(sys.maxsize == 2**31 - 1, "requires 32-bit system") + def test_case_operation_overflow(self): + # Issue #22643 + self.assertRaises(OverflowError, ("ΓΌ"*(2**32//12 + 1)).upper) + def test_contains(self): # Testing Unicode contains method self.assertIn('a', 'abdb') @@ -11,6 +11,9 @@ Release date: TBA Core and Builtins ----------------- +- Issue #22643: Fix integer overflow in Unicode case operations (upper, lower, + title, swapcase, casefold). + - Issue #22604: Fix assertion error in debug mode when dividing a complex number by (nan+0j). diff --git a/Objects/unicodeobject.c b/Objects/unicodeobject.c index c3f75fd..3132fd4 100644 --- a/Objects/unicodeobject.c +++ b/Objects/unicodeobject.c @@ -9651,6 +9651,11 @@ case_operation(PyObject *self, kind = PyUnicode_KIND(self); data = PyUnicode_DATA(self); length = PyUnicode_GET_LENGTH(self); + if (length > PY_SSIZE_T_MAX / 3 || + length > PY_SIZE_MAX / (3 * sizeof(Py_UCS4))) { + PyErr_SetString(PyExc_OverflowError, "string is too long"); + return NULL; + } tmp = PyMem_MALLOC(sizeof(Py_UCS4) * 3 * length); if (tmp == NULL) return PyErr_NoMemory(); |