Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit1785d3f

Browse files
committed
patch for PSF-2006-001.
1 parent8752f71 commit1785d3f

File tree

2 files changed

+47
-25
lines changed

2 files changed

+47
-25
lines changed

‎Misc/NEWS‎

Lines changed: 22 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -4,26 +4,22 @@ Python News
44

55
(editors: check NEWS.help for information about editing NEWS using ReST.)
66

7-
What's New in Python 2.3.6rc1?
8-
==============================
7+
What's New in Python 2.3.6c1?
8+
=============================
99

10-
*Release date:XX-XXX-200X*
10+
*Release date:25-OCT-2006*
1111

12-
Extension modules
12+
Core and builtins
1313
-----------------
1414

15-
- Apply fix for potential heap overflow in PCRE code (CAN-2005-2491).
16-
17-
18-
What's New in Python 2.3.5?
19-
==============================
20-
21-
*Release date: 08-FEB-2005*
15+
- Patch #1541585: fix buffer overrun when performing repr() on
16+
a unicode string in a build with wide unicode (UCS-4) support.
17+
This is the problem described in security advisory PSF-2006-001.
2218

23-
Core and builtins
19+
Extension modules
2420
-----------------
2521

26-
-Partially revert thefix for#1074011; don't try to fflush stdin anymore.
22+
-Applyfix forpotential heap overflow in PCRE code (CAN-2005-2491).
2723

2824
Library
2925
-------
@@ -40,6 +36,19 @@ Library
4036
Also, whereas % values were decoded in all parameter continuations, they are
4137
now only decoded in encoded parameter parts.
4238

39+
What's New in Python 2.3.5?
40+
==============================
41+
42+
*Release date: 08-FEB-2005*
43+
44+
Core and builtins
45+
-----------------
46+
47+
- Partially revert the fix for #1074011; don't try to fflush stdin anymore.
48+
49+
Library
50+
-------
51+
4352
- Applied a security fix to SimpleXMLRPCserver (PSF-2005-001). This
4453
disables recursive traversal through instance attributes, which can
4554
be exploited in various ways.

‎Objects/unicodeobject.c‎

Lines changed: 25 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1888,7 +1888,28 @@ PyObject *unicodeescape_string(const Py_UNICODE *s,
18881888

18891889
staticconstchar*hexdigit="0123456789abcdef";
18901890

1891-
repr=PyString_FromStringAndSize(NULL,2+6*size+1);
1891+
/* Initial allocation is based on the longest-possible unichr
1892+
escape.
1893+
1894+
In wide (UTF-32) builds '\U00xxxxxx' is 10 chars per source
1895+
unichr, so in this case it's the longest unichr escape. In
1896+
narrow (UTF-16) builds this is five chars per source unichr
1897+
since there are two unichrs in the surrogate pair, so in narrow
1898+
(UTF-16) builds it's not the longest unichr escape.
1899+
1900+
In wide or narrow builds '\uxxxx' is 6 chars per source unichr,
1901+
so in the narrow (UTF-16) build case it's the longest unichr
1902+
escape.
1903+
*/
1904+
1905+
repr=PyString_FromStringAndSize(NULL,
1906+
2
1907+
#ifdefPy_UNICODE_WIDE
1908+
+10*size
1909+
#else
1910+
+6*size
1911+
#endif
1912+
+1);
18921913
if (repr==NULL)
18931914
returnNULL;
18941915

@@ -1913,15 +1934,6 @@ PyObject *unicodeescape_string(const Py_UNICODE *s,
19131934
#ifdefPy_UNICODE_WIDE
19141935
/* Map 21-bit characters to '\U00xxxxxx' */
19151936
elseif (ch >=0x10000) {
1916-
intoffset=p-PyString_AS_STRING(repr);
1917-
1918-
/* Resize the string if necessary */
1919-
if (offset+12>PyString_GET_SIZE(repr)) {
1920-
if (_PyString_Resize(&repr,PyString_GET_SIZE(repr)+100))
1921-
returnNULL;
1922-
p=PyString_AS_STRING(repr)+offset;
1923-
}
1924-
19251937
*p++='\\';
19261938
*p++='U';
19271939
*p++=hexdigit[(ch >>28)&0x0000000F];
@@ -1934,8 +1946,8 @@ PyObject *unicodeescape_string(const Py_UNICODE *s,
19341946
*p++=hexdigit[ch&0x0000000F];
19351947
continue;
19361948
}
1937-
#endif
1938-
/* Map UTF-16 surrogate pairs toUnicode \UXXXXXXXX escapes */
1949+
#else
1950+
/* Map UTF-16 surrogate pairs to'\U00xxxxxx' */
19391951
elseif (ch >=0xD800&&ch<0xDC00) {
19401952
Py_UNICODEch2;
19411953
Py_UCS4ucs;
@@ -1960,6 +1972,7 @@ PyObject *unicodeescape_string(const Py_UNICODE *s,
19601972
s--;
19611973
size++;
19621974
}
1975+
#endif
19631976

19641977
/* Map 16-bit characters to '\uxxxx' */
19651978
if (ch >=256) {

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp