bpo-36819: Fix crashes in built-in encoders with weird error handlers (GH-28593)
authorMiss Islington (bot) <31488909+miss-islington@users.noreply.github.com>
Mon, 2 May 2022 09:59:40 +0000 (02:59 -0700)
committerRaspbian forward porter <root@raspbian.org>
Sat, 24 Jan 2026 09:41:14 +0000 (09:41 +0000)
commit8094b2a77449652310277a6b5425439069e04342
treebdad8f28d55f51d11127fb0503769e04d206e663
parentce21be79a5e990108cf8f2fb719ff4465219b887
bpo-36819: Fix crashes in built-in encoders with weird error handlers (GH-28593)

If the error handler returns position less or equal than the starting
position of non-encodable characters, most of built-in encoders didn't
properly re-size the output buffer. This led to out-of-bounds writes,
and segfaults.
(cherry picked from commit 18b07d773e09a2719e69aeaa925d5abb7ba0c068)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
Origin: upstream, https://github.com/python/cpython/commit/206f416bd07ca3bc9c8bafd124c943d4d0293039

Gbp-Pq: Name CVE-2025-4516-4.patch
Lib/test/test_codeccallbacks.py
Misc/NEWS.d/next/Core and Builtins/2021-09-28-10-58-30.bpo-36819.cyV50C.rst [new file with mode: 0644]
Objects/stringlib/codecs.h
Objects/unicodeobject.c