PyUnicode_CopyCharacters() fails if 'to' has more than 1 reference

This commit is contained in:
Victor Stinner 2011-09-28 23:54:59 +02:00
parent 7c8c1ea3ec
commit f5ca1a21a5
2 changed files with 10 additions and 1 deletions

View File

@ -522,7 +522,8 @@ PyAPI_FUNC(int) _PyUnicode_Ready(
character conversion when necessary and falls back to memcpy if possible.
Fail if 'to' is smaller than how_many or smaller than len(from)-from_start,
or if kind(from[from_start:from_start+how_many]) > kind(to).
or if kind(from[from_start:from_start+how_many]) > kind(to), or if to has
more than 1 reference.
Return the number of written character, or return -1 and raise an exception
on error.

View File

@ -631,6 +631,14 @@ PyUnicode_CopyCharacters(PyObject *to, Py_ssize_t to_start,
how_many, to_start, PyUnicode_GET_LENGTH(to));
return -1;
}
if (how_many == 0)
return 0;
if (Py_REFCNT(to) != 1) {
PyErr_SetString(PyExc_ValueError,
"Cannot modify a string having more than 1 reference");
return -1;
}
from_kind = PyUnicode_KIND(from);
to_kind = PyUnicode_KIND(to);