changeset:   93069:570e70252d5d
branch:      3.4
parent:      93066:c2ccbcd11d47
parent:      93068:449b1f427cc7
user:        Benjamin Peterson <benjamin@python.org>
date:        Wed Oct 15 11:48:41 2014 -0400
files:       Lib/test/test_unicode.py Misc/NEWS Objects/unicodeobject.c
description:
merge 3.3 (#22643)


diff -r c2ccbcd11d47 -r 570e70252d5d Lib/test/test_unicode.py
--- a/Lib/test/test_unicode.py	Wed Oct 15 16:58:21 2014 +0200
+++ b/Lib/test/test_unicode.py	Wed Oct 15 11:48:41 2014 -0400
@@ -672,6 +672,11 @@
         self.assertEqual('x'.center(4, '\U0010FFFF'),
                          '\U0010FFFFx\U0010FFFF\U0010FFFF')
 
+    @unittest.skipUnless(sys.maxsize == 2**31 - 1, "requires 32-bit system")
+    def test_case_operation_overflow(self):
+        # Issue #22643
+        self.assertRaises(OverflowError, ("ü"*(2**32//12 + 1)).upper)
+
     def test_contains(self):
         # Testing Unicode contains method
         self.assertIn('a', 'abdb')
diff -r c2ccbcd11d47 -r 570e70252d5d Misc/NEWS
--- a/Misc/NEWS	Wed Oct 15 16:58:21 2014 +0200
+++ b/Misc/NEWS	Wed Oct 15 11:48:41 2014 -0400
@@ -11,6 +11,9 @@
 Core and Builtins
 -----------------
 
+- Issue #22643: Fix integer overflow in Unicode case operations (upper, lower,
+  title, swapcase, casefold).
+
 - Issue #22604: Fix assertion error in debug mode when dividing a complex
   number by (nan+0j).
 
diff -r c2ccbcd11d47 -r 570e70252d5d Objects/unicodeobject.c
--- a/Objects/unicodeobject.c	Wed Oct 15 16:58:21 2014 +0200
+++ b/Objects/unicodeobject.c	Wed Oct 15 11:48:41 2014 -0400
@@ -9651,6 +9651,11 @@
     kind = PyUnicode_KIND(self);
     data = PyUnicode_DATA(self);
     length = PyUnicode_GET_LENGTH(self);
+    if (length > PY_SSIZE_T_MAX / 3 ||
+        length > PY_SIZE_MAX / (3 * sizeof(Py_UCS4))) {
+        PyErr_SetString(PyExc_OverflowError, "string is too long");
+        return NULL;
+    }
     tmp = PyMem_MALLOC(sizeof(Py_UCS4) * 3 * length);
     if (tmp == NULL)
         return PyErr_NoMemory();