mirrors/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2025-08-04 00:48:58 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 8

fix integer overflow in unicode case operations (closes #22643)

Browse source
This commit is contained in:
Benjamin Peterson 2014-10-15 11:47:36 -04:00
parent 77a75b3db1
commit e1bd38c03c
3 changed files with 13 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

5
Lib/test/test_unicode.py
View file

@ -661,6 +661,11 @@ class UnicodeTest(string_tests.CommonTest,
self.assertEqual('x'.center(4, '\U0010FFFF'),
'\U0010FFFFx\U0010FFFF\U0010FFFF')
@unittest.skipUnless(sys.maxsize == 2**31 - 1, "requires 32-bit system")
def test_case_operation_overflow(self):
# Issue #22643
self.assertRaises(OverflowError, ("ü"*(2**32//12 + 1)).upper)
def test_contains(self):
# Testing Unicode contains method
self.assertIn('a', 'abdb')

3
Misc/NEWS
View file

@ -10,6 +10,9 @@ What's New in Python 3.3.6?
Core and Builtins
-----------------
- Issue #22643: Fix integer overflow in Unicode case operations (upper, lower,
title, swapcase, casefold).
- Issue #22518: Fixed integer overflow issues in "backslashreplace",
"xmlcharrefreplace", and "surrogatepass" error handlers.

5
Objects/unicodeobject.c
View file

@ -9484,6 +9484,11 @@ case_operation(PyObject *self,
kind = PyUnicode_KIND(self);
data = PyUnicode_DATA(self);
length = PyUnicode_GET_LENGTH(self);
if (length > PY_SSIZE_T_MAX / 3 ||
length > PY_SIZE_MAX / (3 * sizeof(Py_UCS4))) {
PyErr_SetString(PyExc_OverflowError, "string is too long");
return NULL;
}
tmp = PyMem_MALLOC(sizeof(Py_UCS4) * 3 * length);
if (tmp == NULL)
return PyErr_NoMemory();