]> git.ipfire.org Git - thirdparty/Python/cpython.git/commit
[3.11] gh-133767: Fix use-after-free in the unicode-escape decoder with an error...
authorSerhiy Storchaka <storchaka@gmail.com>
Mon, 2 Jun 2025 15:52:52 +0000 (18:52 +0300)
committerGitHub <noreply@github.com>
Mon, 2 Jun 2025 15:52:52 +0000 (17:52 +0200)
commit73b3040f592436385007918887b7e2132aa8431f
tree9912d0ca09ae0ff8b493416f89a7fa5ff9d0ff0d
parent461ca2cbfb7c92b80e14463854525f162716b8ff
[3.11] gh-133767: Fix use-after-free in the unicode-escape decoder with an error handler (GH-129648) (GH-133944) (GH-134341)

If the error handler is used, a new bytes object is created to set as
the object attribute of UnicodeDecodeError, and that bytes object then
replaces the original data. A pointer to the decoded data will became invalid
after destroying that temporary bytes object. So we need other way to return
the first invalid escape from _PyUnicode_DecodeUnicodeEscapeInternal().

_PyBytes_DecodeEscape() does not have such issue, because it does not
use the error handlers registry, but it should be changed for compatibility
with _PyUnicode_DecodeUnicodeEscapeInternal().
(cherry picked from commit 9f69a58623bd01349a18ba0c7a9cb1dad6a51e8e)
(cherry picked from commit 6279eb8c076d89d3739a6edb393e43c7929b429d)
(cherry picked from commit a75953b347716fff694aa59a7c7c2489fa50d1f5)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
Include/cpython/bytesobject.h
Include/cpython/unicodeobject.h
Lib/test/test_codeccallbacks.py
Lib/test/test_codecs.py
Misc/NEWS.d/next/Security/2025-05-09-20-22-54.gh-issue-133767.kN2i3Q.rst [new file with mode: 0644]
Objects/bytesobject.c
Objects/unicodeobject.c
Parser/string_parser.c