merge 3.3 (#23367)
diff --git a/Misc/NEWS b/Misc/NEWS
index 5a9b836..f71bd50 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -53,6 +53,8 @@
- Issue #23421: Fixed compression in tarfile CLI. Patch by wdv4758h.
+- Issue #23367: Fix possible overflows in the unicodedata module.
+
- Issue #23361: Fix possible overflow in Windows subprocess creation code.
Build
diff --git a/Modules/unicodedata.c b/Modules/unicodedata.c
index 47d2937..507cef3 100644
--- a/Modules/unicodedata.c
+++ b/Modules/unicodedata.c
@@ -553,10 +553,17 @@
stackptr = 0;
isize = PyUnicode_GET_LENGTH(input);
+ space = isize;
/* Overallocate at most 10 characters. */
- space = (isize > 10 ? 10 : isize) + isize;
+ if (space > 10) {
+ if (space <= PY_SSIZE_T_MAX - 10)
+ space += 10;
+ }
+ else {
+ space *= 2;
+ }
osize = space;
- output = PyMem_New(Py_UCS4, space);
+ output = PyMem_NEW(Py_UCS4, space);
if (!output) {
PyErr_NoMemory();
return NULL;
@@ -703,7 +710,7 @@
/* We allocate a buffer for the output.
If we find that we made no changes, we still return
the NFD result. */
- output = PyMem_New(Py_UCS4, len);
+ output = PyMem_NEW(Py_UCS4, len);
if (!output) {
PyErr_NoMemory();
Py_DECREF(result);