[Python-checkins] cpython (2.7): Issue #13612: Fix a buffer overflow in case of a multi-byte encoding.

[eli.bendersky]

http://hg.python.org/cpython/rev/b3efc140d8a6
changeset:   85018:b3efc140d8a6
branch:      2.7
user:        Eli Bendersky <eliben at gmail.com>
date:        Sun Aug 04 06:09:49 2013 -0700
summary:
  Issue #13612: Fix a buffer overflow in case of a multi-byte encoding.

This is a belated backport of f7b47fb30169; Patch by Serhiy Storchaka.

files:
  Lib/test/test_xml_etree.py |  6 ++++++
  Modules/_elementtree.c     |  2 ++
  Modules/pyexpat.c          |  7 +++++++
  3 files changed, 15 insertions(+), 0 deletions(-)


diff --git a/Lib/test/test_xml_etree.py b/Lib/test/test_xml_etree.py
--- a/Lib/test/test_xml_etree.py
+++ b/Lib/test/test_xml_etree.py
@@ -883,6 +883,12 @@
     >>> check_encoding("iso-8859-15")
     >>> check_encoding("cp437")
     >>> check_encoding("mac-roman")
+    >>> check_encoding("gbk")
+    Traceback (most recent call last):
+    ValueError: multi-byte encodings are not supported
+    >>> check_encoding("cp037")
+    Traceback (most recent call last):
+    ParseError: unknown encoding: line 1, column 30
     """
     ET.XML("<?xml version='1.0' encoding='%s'?><xml />" % encoding)
 
diff --git a/Modules/_elementtree.c b/Modules/_elementtree.c
--- a/Modules/_elementtree.c
+++ b/Modules/_elementtree.c
@@ -2427,6 +2427,8 @@
 
     if (PyUnicode_GET_SIZE(u) != 256) {
         Py_DECREF(u);
+        PyErr_SetString(PyExc_ValueError,
+                        "multi-byte encodings are not supported");
         return XML_STATUS_ERROR;
     }
 
diff --git a/Modules/pyexpat.c b/Modules/pyexpat.c
--- a/Modules/pyexpat.c
+++ b/Modules/pyexpat.c
@@ -1252,6 +1252,13 @@
     if (_u_string == NULL)
         return result;
 
+    if (PyUnicode_GET_SIZE(_u_string) != 256) {
+        Py_DECREF(_u_string);
+        PyErr_SetString(PyExc_ValueError,
+                        "multi-byte encodings are not supported");
+        return result;
+    }
+
     for (i = 0; i < 256; i++) {
         /* Stupid to access directly, but fast */
         Py_UNICODE c = _u_string->str[i];

-- 
Repository URL: http://hg.python.org/cpython