diff options
| author | Serhiy Storchaka <storchaka@gmail.com> | 2013-01-08 22:43:18 +0200 |
|---|---|---|
| committer | Serhiy Storchaka <storchaka@gmail.com> | 2013-01-08 22:43:18 +0200 |
| commit | c9631a14d77bd34a7c0ecf1cb1e5f8983b76d48f (patch) | |
| tree | 52db1ec92dc0d7c3cbc2efeefb50b1f3bb0d3156 /Objects/unicodeobject.c | |
| parent | be2b907ce2252785e257a9642f36e95e297ae449 (diff) | |
| download | cpython-git-c9631a14d77bd34a7c0ecf1cb1e5f8983b76d48f.tar.gz | |
Fix out of bound read in UTF-32 decoder on "narrow Unicode" builds.
Diffstat (limited to 'Objects/unicodeobject.c')
| -rw-r--r-- | Objects/unicodeobject.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/Objects/unicodeobject.c b/Objects/unicodeobject.c index b4c37fb464..7713b5497e 100644 --- a/Objects/unicodeobject.c +++ b/Objects/unicodeobject.c @@ -2272,7 +2272,7 @@ PyUnicode_DecodeUTF32Stateful(const char *s, /* On narrow builds we split characters outside the BMP into two codepoints => count how much extra space we need. */ #ifndef Py_UNICODE_WIDE - for (qq = q; qq < e; qq += 4) + for (qq = q; e - qq >= 4; qq += 4) if (qq[iorder[2]] != 0 || qq[iorder[3]] != 0) pairs++; #endif |