From: Serhiy Storchaka <storchaka@gmail.com>
Date: Tue, 8 Jan 2013 20:43:18 +0000 (+0200)
Subject: Fix out of bound read in UTF-32 decoder on "narrow Unicode" builds.
X-Git-Tag: v2.7.4rc1~269
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=c9631a14d77bd34a7c0ecf1cb1e5f8983b76d48f;p=thirdparty%2FPython%2Fcpython.git

Fix out of bound read in UTF-32 decoder on "narrow Unicode" builds.
---

diff --git a/Objects/unicodeobject.c b/Objects/unicodeobject.c
index b4c37fb46405..7713b5497e1d 100644
--- a/Objects/unicodeobject.c
+++ b/Objects/unicodeobject.c
@@ -2272,7 +2272,7 @@ PyUnicode_DecodeUTF32Stateful(const char *s,
     /* On narrow builds we split characters outside the BMP into two
        codepoints => count how much extra space we need. */
 #ifndef Py_UNICODE_WIDE
-    for (qq = q; qq < e; qq += 4)
+    for (qq = q; e - qq >= 4; qq += 4)
         if (qq[iorder[2]] != 0 || qq[iorder[3]] != 0)
             pairs++;
 #endif