[Python-checkins] cpython (merge 3.4 -> default): merge 3.4 (#23367)

Mon Mar 2 17:21:42 CET 2015

https://hg.python.org/cpython/rev/93244000efea
changeset: 94829:93244000efea
parent: 94826:6ccbcf1df7bd
parent: 94828:90f960e79c9e
user: Benjamin Peterson <benjamin at python.org>
date: Mon Mar 02 11:18:56 2015 -0500
summary:
 merge 3.4 (#23367)
files:
 Misc/NEWS | 2 ++
 Modules/unicodedata.c | 13 ++++++++++---
 2 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/Misc/NEWS b/Misc/NEWS
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -78,6 +78,8 @@
 
 - Issue #23421: Fixed compression in tarfile CLI. Patch by wdv4758h.
 
+- Issue #23367: Fix possible overflows in the unicodedata module.
+
 - Issue #23361: Fix possible overflow in Windows subprocess creation code.
 
 - logging.handlers.QueueListener now takes a respect_handler_level keyword
diff --git a/Modules/unicodedata.c b/Modules/unicodedata.c
--- a/Modules/unicodedata.c
+++ b/Modules/unicodedata.c
@@ -553,10 +553,17 @@
 
 stackptr = 0;
 isize = PyUnicode_GET_LENGTH(input);
+ space = isize;
 /* Overallocate at most 10 characters. */
- space = (isize > 10 ? 10 : isize) + isize;
+ if (space > 10) {
+ if (space <= PY_SSIZE_T_MAX - 10)
+ space += 10;
+ }
+ else {
+ space *= 2;
+ }
 osize = space;
- output = PyMem_New(Py_UCS4, space);
+ output = PyMem_NEW(Py_UCS4, space);
 if (!output) {
 PyErr_NoMemory();
 return NULL;
@@ -703,7 +710,7 @@
 /* We allocate a buffer for the output.
 If we find that we made no changes, we still return
 the NFD result. */
- output = PyMem_New(Py_UCS4, len);
+ output = PyMem_NEW(Py_UCS4, len);
 if (!output) {
 PyErr_NoMemory();
 Py_DECREF(result);
-- 
Repository URL: https://hg.python.org/cpython
