diff options
| -rw-r--r-- | Include/unicodeobject.h | 3 | ||||
| -rw-r--r-- | Objects/unicodeobject.c | 8 |
2 files changed, 10 insertions, 1 deletions
diff --git a/Include/unicodeobject.h b/Include/unicodeobject.h index 0b93276f2c..99f54c3a42 100644 --- a/Include/unicodeobject.h +++ b/Include/unicodeobject.h @@ -522,7 +522,8 @@ PyAPI_FUNC(int) _PyUnicode_Ready( character conversion when necessary and falls back to memcpy if possible. Fail if 'to' is smaller than how_many or smaller than len(from)-from_start, - or if kind(from[from_start:from_start+how_many]) > kind(to). + or if kind(from[from_start:from_start+how_many]) > kind(to), or if to has + more than 1 reference. Return the number of written character, or return -1 and raise an exception on error. diff --git a/Objects/unicodeobject.c b/Objects/unicodeobject.c index ae2dbf519f..af05f4c569 100644 --- a/Objects/unicodeobject.c +++ b/Objects/unicodeobject.c @@ -631,6 +631,14 @@ PyUnicode_CopyCharacters(PyObject *to, Py_ssize_t to_start, how_many, to_start, PyUnicode_GET_LENGTH(to)); return -1; } + if (how_many == 0) + return 0; + + if (Py_REFCNT(to) != 1) { + PyErr_SetString(PyExc_ValueError, + "Cannot modify a string having more than 1 reference"); + return -1; + } from_kind = PyUnicode_KIND(from); to_kind = PyUnicode_KIND(to); |