PyUnicode_CopyCharacters() fails if 'to' has more than 1 reference
diff --git a/Include/unicodeobject.h b/Include/unicodeobject.h
index 0b93276..99f54c3 100644
--- a/Include/unicodeobject.h
+++ b/Include/unicodeobject.h
@@ -522,7 +522,8 @@
character conversion when necessary and falls back to memcpy if possible.
Fail if 'to' is smaller than how_many or smaller than len(from)-from_start,
- or if kind(from[from_start:from_start+how_many]) > kind(to).
+ or if kind(from[from_start:from_start+how_many]) > kind(to), or if to has
+ more than 1 reference.
Return the number of written character, or return -1 and raise an exception
on error.
diff --git a/Objects/unicodeobject.c b/Objects/unicodeobject.c
index ae2dbf5..af05f4c 100644
--- a/Objects/unicodeobject.c
+++ b/Objects/unicodeobject.c
@@ -631,6 +631,14 @@
how_many, to_start, PyUnicode_GET_LENGTH(to));
return -1;
}
+ if (how_many == 0)
+ return 0;
+
+ if (Py_REFCNT(to) != 1) {
+ PyErr_SetString(PyExc_ValueError,
+ "Cannot modify a string having more than 1 reference");
+ return -1;
+ }
from_kind = PyUnicode_KIND(from);
to_kind = PyUnicode_KIND(to);