[Python-checkins] cpython (merge 3.4 -> default): merge 3.4 (#22643)

Wed Oct 15 17:49:34 CEST 2014

https://hg.python.org/cpython/rev/c2980ec10a4c
changeset: 93070:c2980ec10a4c
parent: 93067:d75b63cb3e78
parent: 93069:570e70252d5d
user: Benjamin Peterson <benjamin at python.org>
date: Wed Oct 15 11:49:15 2014 -0400
summary:
 merge 3.4 (#22643)
files:
 Lib/test/test_unicode.py | 5 +++++
 Misc/NEWS | 3 +++
 Objects/unicodeobject.c | 5 +++++
 3 files changed, 13 insertions(+), 0 deletions(-)

diff --git a/Lib/test/test_unicode.py b/Lib/test/test_unicode.py
--- a/Lib/test/test_unicode.py
+++ b/Lib/test/test_unicode.py
@@ -701,6 +701,11 @@
 self.assertEqual('x'.center(4, '\U0010FFFF'),
 '\U0010FFFFx\U0010FFFF\U0010FFFF')
 
+ @unittest.skipUnless(sys.maxsize == 2**31 - 1, "requires 32-bit system")
+ def test_case_operation_overflow(self):
+ # Issue #22643
+ self.assertRaises(OverflowError, ("ü"*(2**32//12 + 1)).upper)
+
 def test_contains(self):
 # Testing Unicode contains method
 self.assertIn('a', 'abdb')
diff --git a/Misc/NEWS b/Misc/NEWS
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -10,6 +10,9 @@
 Core and Builtins
 -----------------
 
+- Issue #22643: Fix integer overflow in Unicode case operations (upper, lower,
+ title, swapcase, casefold).
+
 - Issue #17636: Circular imports involving relative imports are now
 supported.
 
diff --git a/Objects/unicodeobject.c b/Objects/unicodeobject.c
--- a/Objects/unicodeobject.c
+++ b/Objects/unicodeobject.c
@@ -9675,6 +9675,11 @@
 kind = PyUnicode_KIND(self);
 data = PyUnicode_DATA(self);
 length = PyUnicode_GET_LENGTH(self);
+ if (length > PY_SSIZE_T_MAX / 3 ||
+ length > PY_SIZE_MAX / (3 * sizeof(Py_UCS4))) {
+ PyErr_SetString(PyExc_OverflowError, "string is too long");
+ return NULL;
+ }
 tmp = PyMem_MALLOC(sizeof(Py_UCS4) * 3 * length);
 if (tmp == NULL)
 return PyErr_NoMemory();
-- 
Repository URL: https://hg.python.org/cpython
