Mercurial > cpython-lru_cache-weakref
diff Objects/unicodeobject.c @ 62255:98245464b665 legacy-trunk
Issue #8941: decoding big endian UTF-32 data in UCS-2 builds could crash
the interpreter with characters outside the Basic Multilingual Plane
(higher than 0x10000).
| author | Antoine Pitrou <solipsis@pitrou.net> |
|---|---|
| date | Fri, 11 Jun 2010 21:42:26 +0000 |
| parents | 5032f1d5a1e1 |
| children | 73e5354f92e7 |
line wrap: on
line diff
--- a/Objects/unicodeobject.c Fri Jun 11 21:40:37 2010 +0000 +++ b/Objects/unicodeobject.c Fri Jun 11 21:42:26 2010 +0000 @@ -2207,11 +2207,11 @@ PyUnicodeObject *unicode; Py_UNICODE *p; #ifndef Py_UNICODE_WIDE - int i, pairs; + int pairs = 0; #else const int pairs = 0; #endif - const unsigned char *q, *e; + const unsigned char *q, *e, *qq; int bo = 0; /* assume native ordering by default */ const char *errmsg = ""; /* Offsets from q for retrieving bytes in the right order. */ @@ -2222,23 +2222,7 @@ #endif PyObject *errorHandler = NULL; PyObject *exc = NULL; - /* On narrow builds we split characters outside the BMP into two - codepoints => count how much extra space we need. */ -#ifndef Py_UNICODE_WIDE - for (i = pairs = 0; i < size/4; i++) - if (((Py_UCS4 *)s)[i] >= 0x10000) - pairs++; -#endif - - /* This might be one to much, because of a BOM */ - unicode = _PyUnicode_New((size+3)/4+pairs); - if (!unicode) - return NULL; - if (size == 0) - return (PyObject *)unicode; - - /* Unpack UTF-32 encoded data */ - p = unicode->str; + q = (unsigned char *)s; e = q + size; @@ -2290,6 +2274,24 @@ iorder[3] = 0; } + /* On narrow builds we split characters outside the BMP into two + codepoints => count how much extra space we need. */ +#ifndef Py_UNICODE_WIDE + for (qq = q; qq < e; qq += 4) + if (qq[iorder[2]] != 0 || qq[iorder[3]] != 0) + pairs++; +#endif + + /* This might be one to much, because of a BOM */ + unicode = _PyUnicode_New((size+3)/4+pairs); + if (!unicode) + return NULL; + if (size == 0) + return (PyObject *)unicode; + + /* Unpack UTF-32 encoded data */ + p = unicode->str; + while (q < e) { Py_UCS4 ch; /* remaining bytes at the end? (size should be divisible by 4) */
