From 72114c06fd8f105437d671277b0593a378ecc3f4 Mon Sep 17 00:00:00 2001 From: "Miss Islington (bot)" <31488909+miss-islington@users.noreply.github.com> Date: Wed, 13 Apr 2022 18:38:37 -0700 Subject: [PATCH] gh-91421: Use constant value check during runtime (GH-91422) (GH-91492) The left-hand side expression of the if-check can be converted to a constant by the compiler, but the addition on the right-hand side is performed during runtime. Move the addition from the right-hand side to the left-hand side by turning it into a subtraction there. Since the values are known to be large enough to not turn negative, this is a safe operation. Prevents a very unlikely integer overflow on 32 bit systems. Fixes GH-91421. (cherry picked from commit 0859368335d470b9ff33fc53ed9a85ec2654b278) Co-authored-by: Tobias Stoeckmann --- .../2022-04-10-22-57-27.gh-issue-91421.dHhv6U.rst | 1 + Objects/unicodeobject.c | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) create mode 100644 Misc/NEWS.d/next/Core and Builtins/2022-04-10-22-57-27.gh-issue-91421.dHhv6U.rst diff --git a/Misc/NEWS.d/next/Core and Builtins/2022-04-10-22-57-27.gh-issue-91421.dHhv6U.rst b/Misc/NEWS.d/next/Core and Builtins/2022-04-10-22-57-27.gh-issue-91421.dHhv6U.rst new file mode 100644 index 000000000000..898eb0df18d0 --- /dev/null +++ b/Misc/NEWS.d/next/Core and Builtins/2022-04-10-22-57-27.gh-issue-91421.dHhv6U.rst @@ -0,0 +1 @@ +Fix a potential integer overflow in _Py_DecodeUTF8Ex. diff --git a/Objects/unicodeobject.c b/Objects/unicodeobject.c index 38a7b3c8b44b..5ddde5054428 100644 --- a/Objects/unicodeobject.c +++ b/Objects/unicodeobject.c @@ -5373,7 +5373,7 @@ _Py_DecodeUTF8Ex(const char *s, Py_ssize_t size, wchar_t **wstr, size_t *wlen, /* Note: size will always be longer than the resulting Unicode character count */ - if (PY_SSIZE_T_MAX / (Py_ssize_t)sizeof(wchar_t) < (size + 1)) { + if (PY_SSIZE_T_MAX / (Py_ssize_t)sizeof(wchar_t) - 1 < size) { return -1; } -- 2.47.3