From 694c82a5fd156130679c18b9e61fa64f2a8deae5 Mon Sep 17 00:00:00 2001 From: Shamil Abdulaev Date: Fri, 20 Mar 2026 18:23:33 +0300 Subject: [PATCH 1/2] gh-146196: Fix potential Undefined Behavior in _PyUnicodeWriter_WriteASCIIString --- .../2026-03-20-13-55-14.gh-issue-146196.Zg70Kb.rst | 3 +++ Objects/unicode_writer.c | 4 ++++ 2 files changed, 7 insertions(+) create mode 100644 Misc/NEWS.d/next/Core_and_Builtins/2026-03-20-13-55-14.gh-issue-146196.Zg70Kb.rst diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-03-20-13-55-14.gh-issue-146196.Zg70Kb.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-03-20-13-55-14.gh-issue-146196.Zg70Kb.rst new file mode 100644 index 00000000000000..7fbe1c3541f73d --- /dev/null +++ b/Misc/NEWS.d/next/Core_and_Builtins/2026-03-20-13-55-14.gh-issue-146196.Zg70Kb.rst @@ -0,0 +1,3 @@ +Fix potential Undefined Behavior in :c:func:`PyUnicodeWriter_WriteASCII` by +adding a zero-length check and using memmove() instead of memcpy(). Patch by +Shamil Abdulaev. diff --git a/Objects/unicode_writer.c b/Objects/unicode_writer.c index cd2688e32dfaf8..a753c9b971c702 100644 --- a/Objects/unicode_writer.c +++ b/Objects/unicode_writer.c @@ -465,6 +465,10 @@ _PyUnicodeWriter_WriteASCIIString(_PyUnicodeWriter *writer, if (len == -1) len = strlen(ascii); + if (len == 0) { + return 0; + } + assert(ucs1lib_find_max_char((const Py_UCS1*)ascii, (const Py_UCS1*)ascii + len) < 128); if (writer->buffer == NULL && !writer->overallocate) { From 63bbe18a517c44090a61983dcb6b02d5d3c9333e Mon Sep 17 00:00:00 2001 From: Victor Stinner Date: Fri, 20 Mar 2026 16:32:40 +0100 Subject: [PATCH 2/2] Update Misc/NEWS.d/next/Core_and_Builtins/2026-03-20-13-55-14.gh-issue-146196.Zg70Kb.rst --- .../2026-03-20-13-55-14.gh-issue-146196.Zg70Kb.rst | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-03-20-13-55-14.gh-issue-146196.Zg70Kb.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-03-20-13-55-14.gh-issue-146196.Zg70Kb.rst index 7fbe1c3541f73d..9e03c1bbb0e1cb 100644 --- a/Misc/NEWS.d/next/Core_and_Builtins/2026-03-20-13-55-14.gh-issue-146196.Zg70Kb.rst +++ b/Misc/NEWS.d/next/Core_and_Builtins/2026-03-20-13-55-14.gh-issue-146196.Zg70Kb.rst @@ -1,3 +1,2 @@ Fix potential Undefined Behavior in :c:func:`PyUnicodeWriter_WriteASCII` by -adding a zero-length check and using memmove() instead of memcpy(). Patch by -Shamil Abdulaev. +adding a zero-length check. Patch by Shamil Abdulaev.