changeset:   92805:51317c9786f5
branch:      3.3
tag:         v3.3.6rc1
user:        Serhiy Storchaka <storchaka@gmail.com>
date:        Sat Oct 04 14:15:49 2014 +0300
files:       Misc/NEWS Python/codecs.c
description:
Issue #22518: Fixed integer overflow issues in "backslashreplace",
"xmlcharrefreplace", and "surrogatepass" error handlers.


diff -r 6ee4cb4064b9 -r 51317c9786f5 Misc/NEWS
--- a/Misc/NEWS	Sat Oct 04 14:22:11 2014 +0200
+++ b/Misc/NEWS	Sat Oct 04 14:15:49 2014 +0300
@@ -10,6 +10,9 @@
 Core and Builtins
 -----------------
 
+- Issue #22518: Fixed integer overflow issues in "backslashreplace",
+  "xmlcharrefreplace", and "surrogatepass" error handlers.
+
 - Issue #22520: Fix overflow checking when generating the repr of a unicode
   object.
 
diff -r 6ee4cb4064b9 -r 51317c9786f5 Python/codecs.c
--- a/Python/codecs.c	Sat Oct 04 14:22:11 2014 +0200
+++ b/Python/codecs.c	Sat Oct 04 14:15:49 2014 +0300
@@ -727,7 +727,7 @@
         Py_ssize_t end;
         PyObject *res;
         unsigned char *outp;
-        int ressize;
+        Py_ssize_t ressize;
         Py_UCS4 ch;
         if (PyUnicodeEncodeError_GetStart(exc, &start))
             return NULL;
@@ -735,6 +735,8 @@
             return NULL;
         if (!(object = PyUnicodeEncodeError_GetObject(exc)))
             return NULL;
+        if (end - start > PY_SSIZE_T_MAX / (2+7+1))
+            end = start + PY_SSIZE_T_MAX / (2+7+1);
         for (i = start, ressize = 0; i < end; ++i) {
             /* object is guaranteed to be "ready" */
             ch = PyUnicode_READ_CHAR(object, i);
@@ -823,7 +825,7 @@
         Py_ssize_t end;
         PyObject *res;
         unsigned char *outp;
-        int ressize;
+        Py_ssize_t ressize;
         Py_UCS4 c;
         if (PyUnicodeEncodeError_GetStart(exc, &start))
             return NULL;
@@ -831,6 +833,8 @@
             return NULL;
         if (!(object = PyUnicodeEncodeError_GetObject(exc)))
             return NULL;
+        if (end - start > PY_SSIZE_T_MAX / (1+1+8))
+            end = start + PY_SSIZE_T_MAX / (1+1+8);
         for (i = start, ressize = 0; i < end; ++i) {
             /* object is guaranteed to be "ready" */
             c = PyUnicode_READ_CHAR(object, i);