Issue #22518: Fixed integer overflow issues in "backslashreplace",

"xmlcharrefreplace", and "surrogatepass" error handlers.

diff --cc Misc/NEWS
index b24e28dcd64f404191c43593adf21f153618a92d,a33c4acd163022d9df9194df54d7b390f7d3fdba..6decc6051e39913977f675b68ff6a846d8969af1
--- 1/Misc/NEWS
--- 2/Misc/NEWS
+++ b/Misc/NEWS
@@@ -10,12 -9,9 +10,15 @@@ Release date: TB
  Core and Builtins
  -----------------
  
+ - Issue #22518: Fixed integer overflow issues in "backslashreplace",
+   "xmlcharrefreplace", and "surrogatepass" error handlers.
+ 
 +- Issue #22540: speed up `PyObject_IsInstance` and `PyObject_IsSubclass` in the
 +  common case that the second argument has metaclass `type`.
 +
 +- Issue #18711: Add a new `PyErr_FormatV` function, similar to `PyErr_Format`
 +  but accepting a `va_list` argument.
 +
  - Issue #22520: Fix overflow checking when generating the repr of a unicode
    object.
  

diff --cc Python/codecs.c
index 02fce295610ff89697fac986d708ec1aceb3a9c5,6849c0f9a499280405ab602c7f5b353e9b75bac2..151fea7d498a186b54d9b6c422883e0469052ff8
--- 1/Python/codecs.c
--- 2/Python/codecs.c
+++ b/Python/codecs.c
@@@ -1029,13 -1026,9 +1033,15 @@@ PyCodec_SurrogatePassErrors(PyObject *e
          }
          code = get_standard_encoding(encoding, &bytelength);
          Py_DECREF(encode);
 +        if (code == ENC_UNKNOWN) {
 +            /* Not supported, fail with original exception */
 +            PyErr_SetObject(PyExceptionInstance_Class(exc), exc);
 +            Py_DECREF(object);
 +            return NULL;
 +        }
  
+         if (end - start > PY_SSIZE_T_MAX / bytelength)
+             end = start + PY_SSIZE_T_MAX / bytelength;
          res = PyBytes_FromStringAndSize(NULL, bytelength*(end-start));
          if (!res) {
              Py_DECREF(object);