Merged revisions 73698 via svnmerge from
svn+ssh://pythondev@svn.python.org/python/branches/py3k

........
  r73698 | amaury.forgeotdarc | 2009-06-30 00:36:49 +0200 (mar., 30 juin 2009) | 7 lines

  #6373: SystemError in str.encode('latin1', 'surrogateescape')
  if the string contains unpaired surrogates.
  (In debug build, crash in assert())

  This can happen with normal processing, if python starts with utf-8,
  then calls sys.setfilesystemencoding('latin-1')
........
diff --git a/Lib/test/test_codecs.py b/Lib/test/test_codecs.py
index 4ec7b58..e060471 100644
--- a/Lib/test/test_codecs.py
+++ b/Lib/test/test_codecs.py
@@ -1549,6 +1549,11 @@
         self.assertEqual("foo\udca5bar".encode("iso-8859-3", "surrogateescape"),
                          b"foo\xa5bar")
 
+    def test_latin1(self):
+        # Issue6373
+        self.assertEqual("\udce4\udceb\udcef\udcf6\udcfc".encode("latin1", "surrogateescape"),
+                         b"\xe4\xeb\xef\xf6\xfc")
+
 
 def test_main():
     support.run_unittest(
diff --git a/Misc/NEWS b/Misc/NEWS
index 59e913b..3a4d486 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -12,6 +12,10 @@
 Core and Builtins
 -----------------
 
+- Issue #6373: Fixed a RuntimeError when encoding with the latin-1 codec and
+  the 'surrogateescape' error handler, a string which contains unpaired
+  surrogates.
+
 Library
 -------
 
diff --git a/Objects/unicodeobject.c b/Objects/unicodeobject.c
index 0d4a3dd..305289b 100644
--- a/Objects/unicodeobject.c
+++ b/Objects/unicodeobject.c
@@ -4201,10 +4201,12 @@
                     repsize = PyBytes_Size(repunicode);
                     if (repsize > 1) {
                         /* Make room for all additional bytes. */
+                        respos = str - PyBytes_AS_STRING(res);
                         if (_PyBytes_Resize(&res, ressize+repsize-1)) {
                             Py_DECREF(repunicode);
                             goto onError;
                         }
+                        str = PyBytes_AS_STRING(res) + respos;
                         ressize += repsize-1;
                     }
                     memcpy(str, PyBytes_AsString(repunicode), repsize);