Overallocate target buffer for normalization more early. Fixes #834676.

diff --git a/Lib/test/test_normalization.py b/Lib/test/test_normalization.py
index 046dca6c851bd9e06804ed6710f173dee5e02071..0cbc2b49e9fb4ba2594afc877e7d0f46e9e8aafe 100644 (file)
--- a/Lib/test/test_normalization.py
+++ b/Lib/test/test_normalization.py
@@ -84,5 +84,8 @@ def test_main():
             continue
         assert X == NFC(X) == NFD(X) == NFKC(X) == NFKD(X), c
 
+    # Check for bug 834676
+    normalize('NFC',u'\ud55c\uae00')
+
 if __name__ == "__main__":
     test_main()

diff --git a/Misc/NEWS b/Misc/NEWS
index be3e7f07ee26f2ff9d4444f99098e534507218b0..5bb76a7c8b3a8310be701a87c0bb98f0ccac6aa8 100644 (file)
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -18,6 +18,8 @@ Core and builtins
 Extension modules
 -----------------
 
+- Bug #834676: Fix crashes when normalizing Hangul syllables.
+
 - Bug #703198: Ignore "b" and "t" in os.popen on Unix.
 
 - Patch #803998: Deal with errors in SSL_write correctly.

diff --git a/Modules/unicodedata.c b/Modules/unicodedata.c
index d266ad7e0b49b8a98ad3455c2744e979d1e3b7a2..311db296bdbcecacdef9c44e98be8ae79ef45fe1 100644 (file)
--- a/Modules/unicodedata.c
+++ b/Modules/unicodedata.c
@@ -311,12 +311,14 @@ nfd_nfkd(PyObject *input, int k)
         stack[stackptr++] = *i++;
         while(stackptr) {
             Py_UNICODE code = stack[--stackptr];
-            if (!space) {
-                space = PyString_GET_SIZE(result) + 10;
-                if (PyUnicode_Resize(&result, space) == -1)
+            /* Hangul Decomposition adds three characters in
+               a single step, so we need atleast that much room. */
+            if (space < 3) {
+                int newsize = PyString_GET_SIZE(result) + 10;
+                space += 10;
+                if (PyUnicode_Resize(&result, newsize) == -1)
                     return NULL;
-                o = PyUnicode_AS_UNICODE(result) + space - 10;
-                space = 10;
+                o = PyUnicode_AS_UNICODE(result) + newsize - space;
             }
             /* Hangul Decomposition. */
             if (SBase <= code && code < (SBase+SCount)) {