cpython/Misc/NEWS.d/next/Security/2025-05-09-20-22-54.gh-issue-133767.kN2i3Q.rst at 920a1c30dd547548c79744994164c48557cc0688 - mirrors/cpython - Forgejo: Beyond coding. We Forge.

mirrors/cpython

mirror of https://github.com/python/cpython.git synced 2025-08-05 01:18:26 +00:00

Serhiy Storchaka 8d35fd1b34

[3.9] gh-133767: Fix use-after-free in the unicode-escape decoder with an error handler (GH-129648) (GH-133944) (#134346 )

* [3.9] gh-133767: Fix use-after-free in the unicode-escape decoder with an error handler (GH-129648) (GH-133944)

If the error handler is used, a new bytes object is created to set as
the object attribute of UnicodeDecodeError, and that bytes object then
replaces the original data. A pointer to the decoded data will became invalid
after destroying that temporary bytes object. So we need other way to return
the first invalid escape from _PyUnicode_DecodeUnicodeEscapeInternal().

_PyBytes_DecodeEscape() does not have such issue, because it does not
use the error handlers registry, but it should be changed for compatibility
with _PyUnicode_DecodeUnicodeEscapeInternal().
(cherry picked from commit 9f69a58623)
(cherry picked from commit 6279eb8c07)
(cherry picked from commit a75953b347)
(cherry picked from commit 0c33e5baed)
(cherry picked from commit 8b528cacbb)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

2025-06-02 17:58:01 +02:00

2 lines

86 B

ReStructuredText

Raw Blame History

	`Fix use-after-free in the "unicode-escape" decoder with a non-"strict" error`
	`handler.`