commit 4f5f0e54e07838b29e3a2e043e9c9b12aeecb12f
author Serhiy Storchaka <storchaka@gmail.com> Mon Jan 21 11:38:00 2013 +0200
committer Serhiy Storchaka <storchaka@gmail.com> Mon Jan 21 11:38:00 2013 +0200
tree cc5e30144b4ce05686542d88b970974bb958fd37
parent 410eee566f3bf2a33bfd1156ad8bb86f697c4749

Issue #16335: Fix integer overflow in unicode-escape decoder.

Objects/unicodeobject.c

diff --git a/Objects/unicodeobject.c b/Objects/unicodeobject.c
index 80a70b6..ddd8d53 100644
--- a/Objects/unicodeobject.c
+++ b/Objects/unicodeobject.c
@@ -3923,7 +3923,8 @@
                     /* found a name.  look it up in the unicode database */
                     message = "unknown Unicode character name";
                     s++;
-                    if (ucnhash_CAPI->getcode(NULL, start, (int)(s-start-1), &chr))
+                    if (s - start - 1 <= INT_MAX &&
+                        ucnhash_CAPI->getcode(NULL, start, (int)(s-start-1), &chr))
                         goto store;
                 }
             }