bpo-36819: Fix crashes in built-in encoders with weird error handlers (GH-28593)
authorMiss Islington (bot) <31488909+miss-islington@users.noreply.github.com>
Mon, 2 May 2022 09:59:40 +0000 (02:59 -0700)
committerAndrej Shadura <andrewsh@debian.org>
Sun, 25 Jan 2026 13:37:52 +0000 (14:37 +0100)
commit7c596d111c00b26892d84273b4c6baec170e9b17
tree3d2a4dba3376c093b93ab9b0e689c8e40731b0c0
parent2f7fc73464229670224bb28ac3b4b523d2b5a6a3
bpo-36819: Fix crashes in built-in encoders with weird error handlers (GH-28593)

If the error handler returns position less or equal than the starting
position of non-encodable characters, most of built-in encoders didn't
properly re-size the output buffer. This led to out-of-bounds writes,
and segfaults.
(cherry picked from commit 18b07d773e09a2719e69aeaa925d5abb7ba0c068)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
Origin: upstream, https://github.com/python/cpython/commit/206f416bd07ca3bc9c8bafd124c943d4d0293039

Gbp-Pq: Name CVE-2025-4516-4.patch
Lib/test/test_codeccallbacks.py
Misc/NEWS.d/next/Core and Builtins/2021-09-28-10-58-30.bpo-36819.cyV50C.rst [new file with mode: 0644]
Objects/stringlib/codecs.h
Objects/unicodeobject.c