[3.14] gh-130567: Fix possible crash in locale.strxfrm() (GH-138940) (GH-139265)

On some macOS versions there was an off-by-one error in wcsxfrm() which
caused writing past the end of the array if its size was not calculated
by running wcsxfrm() first.

(cherry picked from commit 5854cf38a25ab8b0c6ab0296098166014f77caa3)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
Co-authored-by: Ronald Oussoren <ronaldoussoren@mac.com>
Co-authored-by: Petr Viktorin <encukou@gmail.com>

diff --git a/Misc/NEWS.d/next/Library/2025-09-15-19-29-12.gh-issue-130567.shDEnT.rst b/Misc/NEWS.d/next/Library/2025-09-15-19-29-12.gh-issue-130567.shDEnT.rst
new file mode 100644 (file)
index 0000000..c194b23
--- /dev/null
+++ b/Misc/NEWS.d/next/Library/2025-09-15-19-29-12.gh-issue-130567.shDEnT.rst
@@ -0,0 +1,2 @@
+Fix possible crash in :func:`locale.strxfrm` due to a platform bug on
+macOS.

diff --git a/Modules/_localemodule.c b/Modules/_localemodule.c
index 17b5220fd6f9e15095d272dc9d589b7706cf16d2..ae36130964c149673bc215eb14fb653d2372d056 100644 (file)
--- a/Modules/_localemodule.c
+++ b/Modules/_localemodule.c
@@ -457,7 +457,9 @@ _locale_strxfrm_impl(PyObject *module, PyObject *str)
 
     /* assume no change in size, first */
     n1 = n1 + 1;
-    buf = PyMem_New(wchar_t, n1);
+    /* Yet another +1 is needed to work around a platform bug in wcsxfrm()
+     * on macOS. See gh-130567. */
+    buf = PyMem_New(wchar_t, n1+1);
     if (!buf) {
         PyErr_NoMemory();
         goto exit;