bpo-34087: Fix buffer overflow in int(s) and similar functions (GH-8274)
`_PyUnicode_TransformDecimalAndSpaceToASCII()` missed trailing NUL char.
It caused buffer overflow in `_Py_string_to_number_with_underscores()`.
This bug is introduced in 9b6c60cb.
diff --git a/Objects/unicodeobject.c b/Objects/unicodeobject.c
index 80d1bba..2b06f15 100644
--- a/Objects/unicodeobject.c
+++ b/Objects/unicodeobject.c
@@ -9072,6 +9072,7 @@
int decimal = Py_UNICODE_TODECIMAL(ch);
if (decimal < 0) {
out[i] = '?';
+ out[i+1] = '\0';
_PyUnicode_LENGTH(result) = i + 1;
break;
}
@@ -9079,6 +9080,7 @@
}
}
+ assert(_PyUnicode_CheckConsistency(result, 1));
return result;
}