From 2ef7c478444f453a04ae63ecc3d3de07915ad2b0 Mon Sep 17 00:00:00 2001
From: Serhiy Storchaka <storchaka@gmail.com>
Date: Mon, 20 Apr 2015 09:26:49 +0300
Subject: [PATCH] Issue #23728: binascii.crc_hqx() could return an integer
 outside of the range 0-0xffff for empty data.

---
 Lib/test/test_binascii.py   | 12 ++++++++++++
 Misc/NEWS                   |  3 +++
 Modules/binascii.c          | 16 ++++++++--------
 Modules/clinic/binascii.c.h | 14 +++++++-------
 4 files changed, 30 insertions(+), 15 deletions(-)

diff --git a/Lib/test/test_binascii.py b/Lib/test/test_binascii.py
index 22d53af1905..50ad56eaec5 100644
--- a/Lib/test/test_binascii.py
+++ b/Lib/test/test_binascii.py
@@ -136,6 +136,18 @@ class BinASCIITest(unittest.TestCase):
         # Issue #7701 (crash on a pydebug build)
         self.assertEqual(binascii.b2a_uu(b'x'), b'!>   \n')
 
+    def test_crc_hqx(self):
+        crc = binascii.crc_hqx(self.type2test(b"Test the CRC-32 of"), 0)
+        crc = binascii.crc_hqx(self.type2test(b" this string."), crc)
+        self.assertEqual(crc, 14290)
+
+        self.assertRaises(TypeError, binascii.crc_hqx)
+        self.assertRaises(TypeError, binascii.crc_hqx, self.type2test(b''))
+
+        for crc in 0, 1, 0x1234, 0x12345, 0x12345678, -1:
+            self.assertEqual(binascii.crc_hqx(self.type2test(b''), crc),
+                             crc & 0xffff)
+
     def test_crc32(self):
         crc = binascii.crc32(self.type2test(b"Test the CRC-32 of"))
         crc = binascii.crc32(self.type2test(b" this string."), crc)
diff --git a/Misc/NEWS b/Misc/NEWS
index 9c9079225f6..84bd2ccd560 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -29,6 +29,9 @@ Core and Builtins
 Library
 -------
 
+- Issue #23728: binascii.crc_hqx() could return an integer outside of the range
+  0-0xffff for empty data.
+
 - Issue #23811: Add missing newline to the PyCompileError error message.
   Patch by Alex Shkop.
 
diff --git a/Modules/binascii.c b/Modules/binascii.c
index 4e6953b8baa..ea14d3c0274 100644
--- a/Modules/binascii.c
+++ b/Modules/binascii.c
@@ -909,31 +909,31 @@ binascii_rledecode_hqx_impl(PyModuleDef *module, Py_buffer *data)
 
 
 /*[clinic input]
-binascii.crc_hqx -> int
+binascii.crc_hqx -> unsigned_int
 
     data: Py_buffer
-    crc: int
+    crc: unsigned_int(bitwise=True)
     /
 
 Compute hqx CRC incrementally.
 [clinic start generated code]*/
 
-static int
-binascii_crc_hqx_impl(PyModuleDef *module, Py_buffer *data, int crc)
-/*[clinic end generated code: output=634dac18dfa863d7 input=68060931b2f51c8a]*/
+static unsigned int
+binascii_crc_hqx_impl(PyModuleDef *module, Py_buffer *data, unsigned int crc)
+/*[clinic end generated code: output=167c2dac62625717 input=add8c53712ccceda]*/
 {
     unsigned char *bin_data;
-    unsigned int ucrc = (unsigned int)crc;
     Py_ssize_t len;
 
+    crc &= 0xffff;
     bin_data = data->buf;
     len = data->len;
 
     while(len-- > 0) {
-        ucrc=((ucrc<<8)&0xff00)^crctab_hqx[((ucrc>>8)&0xff)^*bin_data++];
+        crc = ((crc<<8)&0xff00) ^ crctab_hqx[(crc>>8)^*bin_data++];
     }
 
-    return (int)ucrc;
+    return crc;
 }
 
 #ifndef USE_ZLIB_CRC32
diff --git a/Modules/clinic/binascii.c.h b/Modules/clinic/binascii.c.h
index f647032ada8..ef646ddddc0 100644
--- a/Modules/clinic/binascii.c.h
+++ b/Modules/clinic/binascii.c.h
@@ -267,25 +267,25 @@ PyDoc_STRVAR(binascii_crc_hqx__doc__,
 #define BINASCII_CRC_HQX_METHODDEF    \
     {"crc_hqx", (PyCFunction)binascii_crc_hqx, METH_VARARGS, binascii_crc_hqx__doc__},
 
-static int
-binascii_crc_hqx_impl(PyModuleDef *module, Py_buffer *data, int crc);
+static unsigned int
+binascii_crc_hqx_impl(PyModuleDef *module, Py_buffer *data, unsigned int crc);
 
 static PyObject *
 binascii_crc_hqx(PyModuleDef *module, PyObject *args)
 {
     PyObject *return_value = NULL;
     Py_buffer data = {NULL, NULL};
-    int crc;
-    int _return_value;
+    unsigned int crc;
+    unsigned int _return_value;
 
     if (!PyArg_ParseTuple(args,
-        "y*i:crc_hqx",
+        "y*I:crc_hqx",
         &data, &crc))
         goto exit;
     _return_value = binascii_crc_hqx_impl(module, &data, crc);
     if ((_return_value == -1) && PyErr_Occurred())
         goto exit;
-    return_value = PyLong_FromLong((long)_return_value);
+    return_value = PyLong_FromUnsignedLong((unsigned long)_return_value);
 
 exit:
     /* Cleanup for data */
@@ -543,4 +543,4 @@ exit:
 
     return return_value;
 }
-/*[clinic end generated code: output=e46d29f8c9adae7e input=a9049054013a1b77]*/
+/*[clinic end generated code: output=22761b36f4f9e5bb input=a9049054013a1b77]*/