commit e1bd38c03c16cd27227b3148d2be0ef1ab678448
author Benjamin Peterson <benjamin@python.org> Wed Oct 15 11:47:36 2014 -0400
committer Benjamin Peterson <benjamin@python.org> Wed Oct 15 11:47:36 2014 -0400
tree 6ca661c659881b0785ed35ed82bdb9e1d07c6831
parent 77a75b3db1b3c63833067f6864e62dcf312ded05

fix integer overflow in unicode case operations (closes #22643)

Objects/unicodeobject.c

diff --git a/Objects/unicodeobject.c b/Objects/unicodeobject.c
index 1ce5caa..35da457 100644
--- a/Objects/unicodeobject.c
+++ b/Objects/unicodeobject.c
@@ -9484,6 +9484,11 @@
     kind = PyUnicode_KIND(self);
     data = PyUnicode_DATA(self);
     length = PyUnicode_GET_LENGTH(self);
+    if (length > PY_SSIZE_T_MAX / 3 ||
+        length > PY_SIZE_MAX / (3 * sizeof(Py_UCS4))) {
+        PyErr_SetString(PyExc_OverflowError, "string is too long");
+        return NULL;
+    }
     tmp = PyMem_MALLOC(sizeof(Py_UCS4) * 3 * length);
     if (tmp == NULL)
         return PyErr_NoMemory();