[Python-checkins] cpython: PyUnicode_CopyCharacters() fails if 'to' has more than 1 reference

[victor.stinner]

http://hg.python.org/cpython/rev/9f0e1f44ebac
changeset:   72506:9f0e1f44ebac
user:        Victor Stinner <victor.stinner at haypocalc.com>
date:        Wed Sep 28 23:54:59 2011 +0200
summary:
  PyUnicode_CopyCharacters() fails if 'to' has more than 1 reference

files:
  Include/unicodeobject.h |  3 ++-
  Objects/unicodeobject.c |  8 ++++++++
  2 files changed, 10 insertions(+), 1 deletions(-)


diff --git a/Include/unicodeobject.h b/Include/unicodeobject.h
--- a/Include/unicodeobject.h
+++ b/Include/unicodeobject.h
@@ -522,7 +522,8 @@
    character conversion when necessary and falls back to memcpy if possible.
 
    Fail if 'to' is smaller than how_many or smaller than len(from)-from_start,
-   or if kind(from[from_start:from_start+how_many]) > kind(to).
+   or if kind(from[from_start:from_start+how_many]) > kind(to), or if to has
+   more than 1 reference.
 
    Return the number of written character, or return -1 and raise an exception
    on error.
diff --git a/Objects/unicodeobject.c b/Objects/unicodeobject.c
--- a/Objects/unicodeobject.c
+++ b/Objects/unicodeobject.c
@@ -631,6 +631,14 @@
                      how_many, to_start, PyUnicode_GET_LENGTH(to));
         return -1;
     }
+    if (how_many == 0)
+        return 0;
+
+    if (Py_REFCNT(to) != 1) {
+        PyErr_SetString(PyExc_ValueError,
+                        "Cannot modify a string having more than 1 reference");
+        return -1;
+    }
 
     from_kind = PyUnicode_KIND(from);
     to_kind = PyUnicode_KIND(to);

-- 
Repository URL: http://hg.python.org/cpython