diff --git a/Include/unicodeobject.h b/Include/unicodeobject.h index 0b93276f2c3..99f54c3a42e 100644 --- a/Include/unicodeobject.h +++ b/Include/unicodeobject.h @@ -522,7 +522,8 @@ PyAPI_FUNC(int) _PyUnicode_Ready( character conversion when necessary and falls back to memcpy if possible. Fail if 'to' is smaller than how_many or smaller than len(from)-from_start, - or if kind(from[from_start:from_start+how_many]) > kind(to). + or if kind(from[from_start:from_start+how_many]) > kind(to), or if to has + more than 1 reference. Return the number of written character, or return -1 and raise an exception on error. diff --git a/Objects/unicodeobject.c b/Objects/unicodeobject.c index ae2dbf519fb..af05f4c569c 100644 --- a/Objects/unicodeobject.c +++ b/Objects/unicodeobject.c @@ -631,6 +631,14 @@ PyUnicode_CopyCharacters(PyObject *to, Py_ssize_t to_start, how_many, to_start, PyUnicode_GET_LENGTH(to)); return -1; } + if (how_many == 0) + return 0; + + if (Py_REFCNT(to) != 1) { + PyErr_SetString(PyExc_ValueError, + "Cannot modify a string having more than 1 reference"); + return -1; + } from_kind = PyUnicode_KIND(from); to_kind = PyUnicode_KIND(to);