From: Serhiy Storchaka <storchaka@gmail.com>
Date: Sat, 4 Oct 2014 11:17:50 +0000 (+0300)
Subject: Issue #22518: Fixed integer overflow issues in "backslashreplace",
X-Git-Tag: v3.5.0a1~767
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=8d1e18ef1fe692f3b222b45e0f47236f65bbe24a;p=thirdparty%2FPython%2Fcpython.git

Issue #22518: Fixed integer overflow issues in "backslashreplace",
"xmlcharrefreplace", and "surrogatepass" error handlers.
---

8d1e18ef1fe692f3b222b45e0f47236f65bbe24a
diff --cc Misc/NEWS
index b24e28dcd64f,a33c4acd1630..6decc6051e39
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@@ -10,12 -9,9 +10,15 @@@ Release date: TB
  Core and Builtins
  -----------------
  
+ - Issue #22518: Fixed integer overflow issues in "backslashreplace",
+   "xmlcharrefreplace", and "surrogatepass" error handlers.
+ 
 +- Issue #22540: speed up `PyObject_IsInstance` and `PyObject_IsSubclass` in the
 +  common case that the second argument has metaclass `type`.
 +
 +- Issue #18711: Add a new `PyErr_FormatV` function, similar to `PyErr_Format`
 +  but accepting a `va_list` argument.
 +
  - Issue #22520: Fix overflow checking when generating the repr of a unicode
    object.
  
diff --cc Python/codecs.c
index 02fce295610f,6849c0f9a499..151fea7d498a
--- a/Python/codecs.c
+++ b/Python/codecs.c
@@@ -1029,13 -1026,9 +1033,15 @@@ PyCodec_SurrogatePassErrors(PyObject *e
          }
          code = get_standard_encoding(encoding, &bytelength);
          Py_DECREF(encode);
 +        if (code == ENC_UNKNOWN) {
 +            /* Not supported, fail with original exception */
 +            PyErr_SetObject(PyExceptionInstance_Class(exc), exc);
 +            Py_DECREF(object);
 +            return NULL;
 +        }
  
+         if (end - start > PY_SSIZE_T_MAX / bytelength)
+             end = start + PY_SSIZE_T_MAX / bytelength;
          res = PyBytes_FromStringAndSize(NULL, bytelength*(end-start));
          if (!res) {
              Py_DECREF(object);