Issue #16335: Fix integer overflow in unicode-escape decoder.
diff --git a/Lib/test/test_ucn.py b/Lib/test/test_ucn.py
index fd620f0..de36cc3 100644
--- a/Lib/test/test_ucn.py
+++ b/Lib/test/test_ucn.py
@@ -8,6 +8,7 @@
"""#"
import unittest
+import _testcapi
from test import support
@@ -141,6 +142,21 @@
str, b"\\NSPACE", 'unicode-escape', 'strict'
)
+ @unittest.skipUnless(_testcapi.INT_MAX < _testcapi.PY_SSIZE_T_MAX,
+ "needs UINT_MAX < SIZE_MAX")
+ def test_issue16335(self):
+ # very very long bogus character name
+ try:
+ x = b'\\N{SPACE' + b'x' * (_testcapi.UINT_MAX + 1) + b'}'
+ except MemoryError:
+ raise unittest.SkipTest("not enough memory")
+ self.assertEqual(len(x), len(b'\\N{SPACE}') + (_testcapi.UINT_MAX + 1))
+ self.assertRaisesRegex(UnicodeError,
+ 'unknown Unicode character name',
+ x.decode, 'unicode-escape'
+ )
+
+
def test_main():
support.run_unittest(UnicodeNamesTest)
diff --git a/Objects/unicodeobject.c b/Objects/unicodeobject.c
index 80a70b6..ddd8d53 100644
--- a/Objects/unicodeobject.c
+++ b/Objects/unicodeobject.c
@@ -3923,7 +3923,8 @@
/* found a name. look it up in the unicode database */
message = "unknown Unicode character name";
s++;
- if (ucnhash_CAPI->getcode(NULL, start, (int)(s-start-1), &chr))
+ if (s - start - 1 <= INT_MAX &&
+ ucnhash_CAPI->getcode(NULL, start, (int)(s-start-1), &chr))
goto store;
}
}