traverseda
/
cpython
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Issue #17043: The unicode-internal decoder no longer read past the end of 

input buffer.
This commit is contained in:
Serhiy Storchaka 2013-02-07 16:23:21 +02:00
parent df4bb46457
commit 3fd4ab356d
2 changed files with 27 additions and 27 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
Misc/NEWS
View File

@ -10,6 +10,9 @@ What's New in Python 3.2.4
Core and Builtins
-----------------
- Issue #17043: The unicode-internal decoder no longer read past the end of
input buffer.
- Issue #16979: Fix error handling bugs in the unicode-escape-decode decoder.
- Issue #10156: In the interpreter's initialization phase, unicode globals

51
Objects/unicodeobject.c
View File

@ -4392,37 +4392,34 @@ PyObject *_PyUnicode_DecodeUnicodeInternal(const char *s,
end = s + size;
while (s < end) {
if (end-s < Py_UNICODE_SIZE) {
endinpos = end-starts;
reason = "truncated input";
goto error;
}
memcpy(p, s, sizeof(Py_UNICODE));
#ifdef Py_UNICODE_WIDE
/* We have to sanity check the raw data, otherwise doom looms for
some malformed UCS-4 data. */
if (
#ifdef Py_UNICODE_WIDE
*p > unimax || *p < 0 ||
#endif
end-s < Py_UNICODE_SIZE
)
{
startinpos = s - starts;
if (end-s < Py_UNICODE_SIZE) {
endinpos = end-starts;
reason = "truncated input";
}
else {
endinpos = s - starts + Py_UNICODE_SIZE;
reason = "illegal code point (> 0x10FFFF)";
}
outpos = p - PyUnicode_AS_UNICODE(v);
if (unicode_decode_call_errorhandler(
errors, &errorHandler,
"unicode_internal", reason,
&starts, &end, &startinpos, &endinpos, &exc, &s,
&v, &outpos, &p)) {
goto onError;
}
if (*p > unimax || *p < 0) {
endinpos = s - starts + Py_UNICODE_SIZE;
reason = "illegal code point (> 0x10FFFF)";
goto error;
}
else {
p++;
s += Py_UNICODE_SIZE;
#endif
p++;
s += Py_UNICODE_SIZE;
continue;
error:
startinpos = s - starts;
outpos = p - PyUnicode_AS_UNICODE(v);
if (unicode_decode_call_errorhandler(
errors, &errorHandler,
"unicode_internal", reason,
&starts, &end, &startinpos, &endinpos, &exc, &s,
&v, &outpos, &p)) {
goto onError;
}
}