bpo-36819: Fix crashes in built-in encoders with weird error handlers (GH-28593)
authorMiss Islington (bot) <31488909+miss-islington@users.noreply.github.com>
Mon, 2 May 2022 09:59:40 +0000 (02:59 -0700)
committerAndrej Shadura <andrewsh@debian.org>
Tue, 20 Jan 2026 10:45:10 +0000 (11:45 +0100)
commit405f3ab3afb74b08c0a76c60f50d6ca425e4eed4
tree57c2e05b015f1639befcf71ccd89e563f007745e
parent956158c9d560ff3d55dba14757e1e65d1a136bd3
bpo-36819: Fix crashes in built-in encoders with weird error handlers (GH-28593)

If the error handler returns position less or equal than the starting
position of non-encodable characters, most of built-in encoders didn't
properly re-size the output buffer. This led to out-of-bounds writes,
and segfaults.
(cherry picked from commit 18b07d773e09a2719e69aeaa925d5abb7ba0c068)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
Origin: upstream, https://github.com/python/cpython/commit/206f416bd07ca3bc9c8bafd124c943d4d0293039

Gbp-Pq: Name CVE-2025-4516-4.patch
Lib/test/test_codeccallbacks.py
Misc/NEWS.d/next/Core and Builtins/2021-09-28-10-58-30.bpo-36819.cyV50C.rst [new file with mode: 0644]
Objects/stringlib/codecs.h
Objects/unicodeobject.c