[issue23997] unicodedata_UCD_lookup() has theoretical buffer overflow

2015-12-19 Thread Serhiy Storchaka
Serhiy Storchaka added the comment: For now the error message virtually always contains the name (unless the length of its UTF-8 representation > INT_MAX). With unicode_name_maxlen.patch it doesn't contains the name of length few hundreds or tens characters. Proposed patch makes the error mess

[issue23997] unicodedata_UCD_lookup() has theoretical buffer overflow

2015-04-18 Thread Christian Heimes
New submission from Christian Heimes: Coverity has found a potential buffer overflow in the unicodedata module. The function call _getcode() which calls _cmpname(). _cmpname() copies data into fixed size buffer of length NAME_MAXLEN. Neither lookup() nor _getcode() limit name_length to NAME_MA