[issue14579] CVE-2012-2135: Vulnerability in the utf-16 decoder after error handling

2012-07-21 Thread Serhiy Storchaka
Serhiy Storchaka storch...@gmail.com added the comment: There are spurious print() calls in the 2.7 patch. Oh, my inattentiveness. Thank you for pushing, Antoine. And thank Martin for review. -- ___ Python tracker rep...@bugs.python.org

[issue14579] CVE-2012-2135: Vulnerability in the utf-16 decoder after error handling

2012-07-20 Thread Antoine Pitrou
Antoine Pitrou pit...@free.fr added the comment: There are spurious print() calls in the 2.7 patch. -- ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue14579 ___

[issue14579] CVE-2012-2135: Vulnerability in the utf-16 decoder after error handling

2012-07-20 Thread Antoine Pitrou
Changes by Antoine Pitrou pit...@free.fr: -- stage: test needed - commit review ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue14579 ___ ___

[issue14579] CVE-2012-2135: Vulnerability in the utf-16 decoder after error handling

2012-07-20 Thread Roundup Robot
Roundup Robot devn...@psf.upfronthosting.co.za added the comment: New changeset 034ff986019d by Antoine Pitrou in branch '3.2': Issue #14579: Fix CVE-2012-2135: vulnerability in the utf-16 decoder after error handling. http://hg.python.org/cpython/rev/034ff986019d New changeset 118fe0ee6921 by

[issue14579] CVE-2012-2135: Vulnerability in the utf-16 decoder after error handling

2012-07-20 Thread Roundup Robot
Roundup Robot devn...@psf.upfronthosting.co.za added the comment: New changeset 4cadf91aaddd by Antoine Pitrou in branch '2.7': Issue #14579: Fix error handling bug in the utf-16 decoder. http://hg.python.org/cpython/rev/4cadf91aaddd -- ___ Python

[issue14579] CVE-2012-2135: Vulnerability in the utf-16 decoder after error handling

2012-07-20 Thread Antoine Pitrou
Antoine Pitrou pit...@free.fr added the comment: Thanks for the patches, Serhiy! They're now pushed. -- resolution: - fixed stage: commit review - committed/rejected status: open - closed ___ Python tracker rep...@bugs.python.org

[issue14579] CVE-2012-2135: Vulnerability in the utf-16 decoder after error handling

2012-07-17 Thread Serhiy Storchaka
Serhiy Storchaka storch...@gmail.com added the comment: Please, can anyone do a final review and commit? Here are three patches for three Python versions: 2.7: utf16_error_handling-2.7.patch. Fix for one minor bug (overreading) and tests. 3.2: utf16_error_handling-3.2_4.patch. Fix for one

[issue14579] CVE-2012-2135: Vulnerability in the utf-16 decoder after error handling

2012-07-17 Thread Serhiy Storchaka
Changes by Serhiy Storchaka storch...@gmail.com: -- components: +Interpreter Core, Unicode versions: +Python 2.7 -Python 3.1 ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue14579 ___

[issue14579] CVE-2012-2135: Vulnerability in the utf-16 decoder after error handling

2012-04-27 Thread Georg Brandl
Changes by Georg Brandl ge...@python.org: -- nosy: +georg.brandl ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue14579 ___ ___ Python-bugs-list

[issue14579] CVE-2012-2135: Vulnerability in the utf-16 decoder after error handling

2012-04-26 Thread STINNER Victor
STINNER Victor victor.stin...@gmail.com added the comment: I ran tests of utf16_error_handling-3.2_4.patch on Python 3.1. Two tests are failing: - b'\x00\xd8'.decode('utf-16le', 'replace')='\ufffd\ufffd' != '\ufffd' - b'\xd8\x00'.decode('utf-16be', 'replace')='\ufffd\ufffd' != '\ufffd' I

[issue14579] CVE-2012-2135: Vulnerability in the utf-16 decoder after error handling

2012-04-26 Thread Antoine Pitrou
Antoine Pitrou pit...@free.fr added the comment: I ran tests of utf16_error_handling-3.2_4.patch on Python 3.1. Two tests are failing: - b'\x00\xd8'.decode('utf-16le', 'replace')='\ufffd\ufffd' != '\ufffd' - b'\xd8\x00'.decode('utf-16be', 'replace')='\ufffd\ufffd' != '\ufffd' I don't

[issue14579] CVE-2012-2135: Vulnerability in the utf-16 decoder after error handling

2012-04-26 Thread Martin v . Löwis
Martin v. Löwis mar...@v.loewis.de added the comment: UTF-16 units are 16-bit words, not bytes, so '\ud' sounds correct to me. You resynchronize on the word boundary: the invalid word is skipped. I agree. The only odd case is when the number of bytes is not even (pun intended). In that

[issue14579] CVE-2012-2135: Vulnerability in the utf-16 decoder after error handling

2012-04-25 Thread Martin v . Löwis
Changes by Martin v. Löwis mar...@v.loewis.de: -- title: Vulnerability in the utf-16 decoder after error handling - CVE-2012-2135: Vulnerability in the utf-16 decoder after error handling ___ Python tracker rep...@bugs.python.org