From 0859368335d470b9ff33fc53ed9a85ec2654b278 Mon Sep 17 00:00:00 2001 From: Tobias Stoeckmann Date: Wed, 13 Apr 2022 05:01:02 +0200 Subject: gh-91421: Use constant value check during runtime (GH-91422) The left-hand side expression of the if-check can be converted to a constant by the compiler, but the addition on the right-hand side is performed during runtime. Move the addition from the right-hand side to the left-hand side by turning it into a subtraction there. Since the values are known to be large enough to not turn negative, this is a safe operation. Prevents a very unlikely integer overflow on 32 bit systems. Fixes GH-91421. --- .../Core and Builtins/2022-04-10-22-57-27.gh-issue-91421.dHhv6U.rst | 1 + Objects/unicodeobject.c | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) create mode 100644 Misc/NEWS.d/next/Core and Builtins/2022-04-10-22-57-27.gh-issue-91421.dHhv6U.rst diff --git a/Misc/NEWS.d/next/Core and Builtins/2022-04-10-22-57-27.gh-issue-91421.dHhv6U.rst b/Misc/NEWS.d/next/Core and Builtins/2022-04-10-22-57-27.gh-issue-91421.dHhv6U.rst new file mode 100644 index 0000000..898eb0d --- /dev/null +++ b/Misc/NEWS.d/next/Core and Builtins/2022-04-10-22-57-27.gh-issue-91421.dHhv6U.rst @@ -0,0 +1 @@ +Fix a potential integer overflow in _Py_DecodeUTF8Ex. diff --git a/Objects/unicodeobject.c b/Objects/unicodeobject.c index c665f57..d35a671 100644 --- a/Objects/unicodeobject.c +++ b/Objects/unicodeobject.c @@ -5296,7 +5296,7 @@ _Py_DecodeUTF8Ex(const char *s, Py_ssize_t size, wchar_t **wstr, size_t *wlen, /* Note: size will always be longer than the resulting Unicode character count */ - if (PY_SSIZE_T_MAX / (Py_ssize_t)sizeof(wchar_t) < (size + 1)) { + if (PY_SSIZE_T_MAX / (Py_ssize_t)sizeof(wchar_t) - 1 < size) { return -1; } -- cgit v0.12