commit f5ca1a21a52882954de256909d13a8977d70a881
author Victor Stinner <victor.stinner@haypocalc.com> Wed Sep 28 23:54:59 2011 +0200
committer Victor Stinner <victor.stinner@haypocalc.com> Wed Sep 28 23:54:59 2011 +0200
tree e9d5f996daebc1bd52d044c0c49a2eff5927187b
parent 7c8c1ea3ecc9e83c6916d7548fb92ff5d018b2db

PyUnicode_CopyCharacters() fails if 'to' has more than 1 reference

Objects/unicodeobject.c

diff --git a/Objects/unicodeobject.c b/Objects/unicodeobject.c
index ae2dbf5..af05f4c 100644
--- a/Objects/unicodeobject.c
+++ b/Objects/unicodeobject.c
@@ -631,6 +631,14 @@
                      how_many, to_start, PyUnicode_GET_LENGTH(to));
         return -1;
     }
+    if (how_many == 0)
+        return 0;
+
+    if (Py_REFCNT(to) != 1) {
+        PyErr_SetString(PyExc_ValueError,
+                        "Cannot modify a string having more than 1 reference");
+        return -1;
+    }
 
     from_kind = PyUnicode_KIND(from);
     to_kind = PyUnicode_KIND(to);