commit c35f3a9f619d0d4abd43d16ddc4767e2a30c3dce
author Serhiy Storchaka <storchaka@gmail.com> Mon Jan 21 11:42:57 2013 +0200
committer Serhiy Storchaka <storchaka@gmail.com> Mon Jan 21 11:42:57 2013 +0200
tree 3e279917f0e41c9217f888582685002eed17451f
parent e4aa08e52b1bcf043ec5c9bcfd55268cb4161e3d
parent 4f5f0e54e07838b29e3a2e043e9c9b12aeecb12f

Issue #16335: Fix integer overflow in unicode-escape decoder.

Objects/unicodeobject.c

diff --git a/Objects/unicodeobject.c b/Objects/unicodeobject.c
index b57a896..c30245d 100644
--- a/Objects/unicodeobject.c
+++ b/Objects/unicodeobject.c
@@ -5696,7 +5696,8 @@
                     /* found a name.  look it up in the unicode database */
                     message = "unknown Unicode character name";
                     s++;
-                    if (ucnhash_CAPI->getcode(NULL, start, (int)(s-start-1),
+                    if (s - start - 1 <= INT_MAX &&
+                        ucnhash_CAPI->getcode(NULL, start, (int)(s-start-1),
                                               &chr, 0))
                         goto store;
                 }