Issue #13612: Fix a buffer overflow in case of a multi-byte encoding.
This is a belated backport of f7b47fb30169; Patch by Serhiy Storchaka.
diff --git a/Modules/_elementtree.c b/Modules/_elementtree.c
index 379aa01..b9abcac 100644
--- a/Modules/_elementtree.c
+++ b/Modules/_elementtree.c
@@ -2427,6 +2427,8 @@
if (PyUnicode_GET_SIZE(u) != 256) {
Py_DECREF(u);
+ PyErr_SetString(PyExc_ValueError,
+ "multi-byte encodings are not supported");
return XML_STATUS_ERROR;
}
diff --git a/Modules/pyexpat.c b/Modules/pyexpat.c
index f269113..8de3fb1 100644
--- a/Modules/pyexpat.c
+++ b/Modules/pyexpat.c
@@ -1252,6 +1252,13 @@
if (_u_string == NULL)
return result;
+ if (PyUnicode_GET_SIZE(_u_string) != 256) {
+ Py_DECREF(_u_string);
+ PyErr_SetString(PyExc_ValueError,
+ "multi-byte encodings are not supported");
+ return result;
+ }
+
for (i = 0; i < 256; i++) {
/* Stupid to access directly, but fast */
Py_UNICODE c = _u_string->str[i];