diff --git a/CVE-2025-4516-DecodeError-handler.patch b/CVE-2025-4516-DecodeError-handler.patch index de1186c..1aafbf7 100644 --- a/CVE-2025-4516-DecodeError-handler.patch +++ b/CVE-2025-4516-DecodeError-handler.patch @@ -1,3 +1,17 @@ +From 3a939ff2298d147459116f98a09549d0f1954039 Mon Sep 17 00:00:00 2001 +From: Serhiy Storchaka +Date: Tue, 4 Feb 2025 11:44:39 +0200 +Subject: Fix use-after-free in the unicode-escape decoder with error handler + +If the error handler is used, a new bytes object is created to set as +the object attribute of UnicodeDecodeError, and that bytes object then +replaces the original data. A pointer to the decoded data will became invalid +after destroying that temporary bytes object. So we need other way to return +the first invalid escape from _PyUnicode_DecodeUnicodeEscapeInternal(). + +_PyBytes_DecodeEscape() does not have such issue, because it does not +use the error handlers registry, but it should be changed for compatibility +with _PyUnicode_DecodeUnicodeEscapeInternal(). --- Include/internal/pycore_bytesobject.h | 5 Include/internal/pycore_unicodeobject.h | 12 +-