commit 1d3acd4b59b1685d3b6f58e86ef13b48a9c248bb
author Serhiy Storchaka <storchaka@gmail.com> Mon Jan 21 11:48:24 2013 +0200
committer Serhiy Storchaka <storchaka@gmail.com> Mon Jan 21 11:48:24 2013 +0200
tree b33ffcd829b2eecc7970c760af0faf0540612c06
parent b357db885c8c20bf085d6b65892a618a51b4e1b0

Issue #16335: Fix integer overflow in unicode-escape decoder.

Objects/unicodeobject.c

diff --git a/Objects/unicodeobject.c b/Objects/unicodeobject.c
index 46bfe2b..c1b38cc 100644
--- a/Objects/unicodeobject.c
+++ b/Objects/unicodeobject.c
@@ -2899,7 +2899,8 @@
                     /* found a name.  look it up in the unicode database */
                     message = "unknown Unicode character name";
                     s++;
-                    if (ucnhash_CAPI->getcode(NULL, start, (int)(s-start-1), &chr))
+                    if (s - start - 1 <= INT_MAX &&
+                        ucnhash_CAPI->getcode(NULL, start, (int)(s-start-1), &chr))
                         goto store;
                 }
             }