From 4f5f0e54e07838b29e3a2e043e9c9b12aeecb12f Mon Sep 17 00:00:00 2001 From: Serhiy Storchaka Date: Mon, 21 Jan 2013 11:38:00 +0200 Subject: Issue #16335: Fix integer overflow in unicode-escape decoder. --- Lib/test/test_ucn.py | 16 ++++++++++++++++ Objects/unicodeobject.c | 3 ++- 2 files changed, 18 insertions(+), 1 deletion(-) diff --git a/Lib/test/test_ucn.py b/Lib/test/test_ucn.py index fd620f0..de36cc3 100644 --- a/Lib/test/test_ucn.py +++ b/Lib/test/test_ucn.py @@ -8,6 +8,7 @@ Modified for Python 2.0 by Fredrik Lundh (fredrik@pythonware.com) """#" import unittest +import _testcapi from test import support @@ -141,6 +142,21 @@ class UnicodeNamesTest(unittest.TestCase): str, b"\\NSPACE", 'unicode-escape', 'strict' ) + @unittest.skipUnless(_testcapi.INT_MAX < _testcapi.PY_SSIZE_T_MAX, + "needs UINT_MAX < SIZE_MAX") + def test_issue16335(self): + # very very long bogus character name + try: + x = b'\\N{SPACE' + b'x' * (_testcapi.UINT_MAX + 1) + b'}' + except MemoryError: + raise unittest.SkipTest("not enough memory") + self.assertEqual(len(x), len(b'\\N{SPACE}') + (_testcapi.UINT_MAX + 1)) + self.assertRaisesRegex(UnicodeError, + 'unknown Unicode character name', + x.decode, 'unicode-escape' + ) + + def test_main(): support.run_unittest(UnicodeNamesTest) diff --git a/Objects/unicodeobject.c b/Objects/unicodeobject.c index 80a70b6..ddd8d53 100644 --- a/Objects/unicodeobject.c +++ b/Objects/unicodeobject.c @@ -3923,7 +3923,8 @@ PyObject *PyUnicode_DecodeUnicodeEscape(const char *s, /* found a name. look it up in the unicode database */ message = "unknown Unicode character name"; s++; - if (ucnhash_CAPI->getcode(NULL, start, (int)(s-start-1), &chr)) + if (s - start - 1 <= INT_MAX && + ucnhash_CAPI->getcode(NULL, start, (int)(s-start-1), &chr)) goto store; } } -- cgit v0.12