Issue #16335: Fix integer overflow in unicode-escape decoder.

This commit is contained in:
Serhiy Storchaka 2013-01-21 11:38:00 +02:00
parent 410eee566f
commit 4f5f0e54e0
2 changed files with 18 additions and 1 deletions

View File

@ -8,6 +8,7 @@ Modified for Python 2.0 by Fredrik Lundh (fredrik@pythonware.com)
"""#"
import unittest
import _testcapi
from test import support
@ -141,6 +142,21 @@ class UnicodeNamesTest(unittest.TestCase):
str, b"\\NSPACE", 'unicode-escape', 'strict'
)
@unittest.skipUnless(_testcapi.INT_MAX < _testcapi.PY_SSIZE_T_MAX,
"needs UINT_MAX < SIZE_MAX")
def test_issue16335(self):
# very very long bogus character name
try:
x = b'\\N{SPACE' + b'x' * (_testcapi.UINT_MAX + 1) + b'}'
except MemoryError:
raise unittest.SkipTest("not enough memory")
self.assertEqual(len(x), len(b'\\N{SPACE}') + (_testcapi.UINT_MAX + 1))
self.assertRaisesRegex(UnicodeError,
'unknown Unicode character name',
x.decode, 'unicode-escape'
)
def test_main():
support.run_unittest(UnicodeNamesTest)

View File

@ -3923,7 +3923,8 @@ PyObject *PyUnicode_DecodeUnicodeEscape(const char *s,
/* found a name. look it up in the unicode database */
message = "unknown Unicode character name";
s++;
if (ucnhash_CAPI->getcode(NULL, start, (int)(s-start-1), &chr))
if (s - start - 1 <= INT_MAX &&
ucnhash_CAPI->getcode(NULL, start, (int)(s-start-1), &chr))
goto store;
}
}