https://github.com/python/cpython/commit/939865532c00e25842209f56953abe0361ab22a1
commit: 939865532c00e25842209f56953abe0361ab22a1
branch: main
author: Victor Stinner <[email protected]>
committer: vstinner <[email protected]>
date: 2026-09-09T21:18:22+02:00
summary:
gh-156939: Fix xmlcharrefreplace() buffer overflow (#157109)
Write into a temporary buffer to not write the trailing NUL byte
into the writer. Previously, the NUL byte was written outsize
the writer buffer.
files:
M Objects/unicodeobject.c
diff --git a/Objects/unicodeobject.c b/Objects/unicodeobject.c
index 2249280d0af811..e86291347c75be 100644
--- a/Objects/unicodeobject.c
+++ b/Objects/unicodeobject.c
@@ -879,10 +879,16 @@ xmlcharrefreplace(PyBytesWriter *writer, char *str,
/* generate replacement */
for (i = collstart; i < collend; ++i) {
- size = sprintf(str, "&#%d;", PyUnicode_READ(kind, data, i));
- if (size < 0) {
- return NULL;
- }
+ // Use snprintf() with a temporary buffer to not write the trailing
+ // NUL byte in the writer buffer.
+ Py_BUILD_ASSERT(_Py_MAX_UNICODE <= 0x10ffff);
+ // len('\0') is 11 bytes.
+ char buffer[11];
+ Py_UCS4 ch = PyUnicode_READ(kind, data, i);
+ size = snprintf(buffer, sizeof(buffer), "&#%d;", ch);
+ assert(4 <= size && (size_t)size <= (sizeof(buffer) - 1));
+
+ memcpy(str, buffer, size);
str += size;
}
return str;
_______________________________________________
Python-checkins mailing list -- [email protected]
To unsubscribe send an email to [email protected]
https://mail.python.org/mailman3//lists/python-checkins.python.org
Member address: [email protected]
