Issue #13612: Fix a buffer overflow in case of a multi-byte encoding.

This is a belated backport of f7b47fb30169; Patch by Serhiy Storchaka.

diff --git a/Lib/test/test_xml_etree.py b/Lib/test/test_xml_etree.py
index 4f06d20c0458961bccc2bd6e130e4036e3e4636a..adb785247d5734b728355b115904135682684fd6 100644 (file)
--- a/Lib/test/test_xml_etree.py
+++ b/Lib/test/test_xml_etree.py
@@ -883,6 +883,12 @@ def check_encoding(encoding):
     >>> check_encoding("iso-8859-15")
     >>> check_encoding("cp437")
     >>> check_encoding("mac-roman")
+    >>> check_encoding("gbk")
+    Traceback (most recent call last):
+    ValueError: multi-byte encodings are not supported
+    >>> check_encoding("cp037")
+    Traceback (most recent call last):
+    ParseError: unknown encoding: line 1, column 30
     """
     ET.XML("<?xml version='1.0' encoding='%s'?><xml />" % encoding)
 

diff --git a/Modules/_elementtree.c b/Modules/_elementtree.c
index 379aa01d0a57c92f474457a9fc51949122b4d04f..b9abcac8d0c8706cd4f9652d6329ec8f4feb7e1e 100644 (file)
--- a/Modules/_elementtree.c
+++ b/Modules/_elementtree.c
@@ -2427,6 +2427,8 @@ expat_unknown_encoding_handler(XMLParserObject *self, const XML_Char *name,
 
     if (PyUnicode_GET_SIZE(u) != 256) {
         Py_DECREF(u);
+        PyErr_SetString(PyExc_ValueError,
+                        "multi-byte encodings are not supported");
         return XML_STATUS_ERROR;
     }
 

diff --git a/Modules/pyexpat.c b/Modules/pyexpat.c
index f2691136ca83b8dcd2f03e14f01f9efe66843bb1..8de3fb17d3315ad68d241f02508a31e88fb5b1b6 100644 (file)
--- a/Modules/pyexpat.c
+++ b/Modules/pyexpat.c
@@ -1252,6 +1252,13 @@ PyUnknownEncodingHandler(void *encodingHandlerData,
     if (_u_string == NULL)
         return result;
 
+    if (PyUnicode_GET_SIZE(_u_string) != 256) {
+        Py_DECREF(_u_string);
+        PyErr_SetString(PyExc_ValueError,
+                        "multi-byte encodings are not supported");
+        return result;
+    }
+
     for (i = 0; i < 256; i++) {
         /* Stupid to access directly, but fast */
         Py_UNICODE c = _u_string->str[i];