Serhiy Storchaka 9f69a58623 gh-133767: Fix use-after-free in the unicode-escape decoder with an error handler (GH-129648) ...

If the error handler is used, a new bytes object is created to set as
the object attribute of UnicodeDecodeError, and that bytes object then
replaces the original data. A pointer to the decoded data will became invalid
after destroying that temporary bytes object. So we need other way to return
the first invalid escape from _PyUnicode_DecodeUnicodeEscapeInternal().

_PyBytes_DecodeEscape() does not have such issue, because it does not
use the error handlers registry, but it should be changed for compatibility
with _PyUnicode_DecodeUnicodeEscapeInternal().

2025-05-12 20:42:23 +03:00

108 KiB

Raw Blame History

View Raw