[3.13] gh-130567: Fix possible crash in locale.strxfrm() (GH-138940) (GH-139266)
Some checks failed
Tests / Change detection (push) Has been cancelled
Lint / lint (push) Has been cancelled
Tests / Windows MSI (push) Has been cancelled
Tests / Docs (push) Has been cancelled
Tests / Check if the ABI has changed (push) Has been cancelled
Tests / Check if Autoconf files are up to date (push) Has been cancelled
Tests / Check if generated files are up to date (push) Has been cancelled
Tests / (push) Has been cancelled
Tests / Ubuntu SSL tests with OpenSSL (push) Has been cancelled
Tests / Android (aarch64) (push) Has been cancelled
Tests / Android (x86_64) (push) Has been cancelled
Tests / WASI (push) Has been cancelled
Tests / Hypothesis tests on Ubuntu (push) Has been cancelled
Tests / Address sanitizer (push) Has been cancelled
Tests / Sanitizers (push) Has been cancelled
Tests / CIFuzz (push) Has been cancelled
Tests / All required checks pass (push) Has been cancelled

On some macOS versions there was an off-by-one error in wcsxfrm() which
caused writing past the end of the array if its size was not calculated
by running wcsxfrm() first.
(cherry picked from commit 5854cf38a2)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
Co-authored-by: Ronald Oussoren <ronaldoussoren@mac.com>
This commit is contained in:
Miss Islington (bot) 2025-09-24 13:48:08 +02:00 committed by GitHub
parent 7f83461e56
commit d1f6b392e4
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 5 additions and 1 deletions

View file

@ -0,0 +1,2 @@
Fix possible crash in :func:`locale.strxfrm` due to a platform bug on
macOS.

View file

@ -446,7 +446,9 @@ _locale_strxfrm_impl(PyObject *module, PyObject *str)
/* assume no change in size, first */
n1 = n1 + 1;
buf = PyMem_New(wchar_t, n1);
/* Yet another +1 is needed to work around a platform bug in wcsxfrm()
* on macOS. See gh-130567. */
buf = PyMem_New(wchar_t, n1+1);
if (!buf) {
PyErr_NoMemory();
goto exit;