PyUnicode_CopyCharacters() fails if 'to' has more than 1 reference

diff --git a/Include/unicodeobject.h b/Include/unicodeobject.h
index 0b93276f2c38ce97856b76d9d051801c6cf28458..99f54c3a42e75a2e52d0e1c85248c4373caa99a8 100644 (file)
--- a/Include/unicodeobject.h
+++ b/Include/unicodeobject.h
@@ -522,7 +522,8 @@ PyAPI_FUNC(int) _PyUnicode_Ready(
    character conversion when necessary and falls back to memcpy if possible.
 
    Fail if 'to' is smaller than how_many or smaller than len(from)-from_start,
-   or if kind(from[from_start:from_start+how_many]) > kind(to).
+   or if kind(from[from_start:from_start+how_many]) > kind(to), or if to has
+   more than 1 reference.
 
    Return the number of written character, or return -1 and raise an exception
    on error.

diff --git a/Objects/unicodeobject.c b/Objects/unicodeobject.c
index ae2dbf519fb1aa4be85f79c37ef3359086bfd8ae..af05f4c569c61f5a396b1bd4e96b639e8c4525fe 100644 (file)
--- a/Objects/unicodeobject.c
+++ b/Objects/unicodeobject.c
@@ -631,6 +631,14 @@ PyUnicode_CopyCharacters(PyObject *to, Py_ssize_t to_start,
                      how_many, to_start, PyUnicode_GET_LENGTH(to));
         return -1;
     }
+    if (how_many == 0)
+        return 0;
+
+    if (Py_REFCNT(to) != 1) {
+        PyErr_SetString(PyExc_ValueError,
+                        "Cannot modify a string having more than 1 reference");
+        return -1;
+    }
 
     from_kind = PyUnicode_KIND(from);
     to_kind = PyUnicode_KIND(to);