Backport of r74435. Not merged/blocked w/ svnmerge.py as the tool is erroring out on me.

brettcannon · brettcannon · commit 0c8110734a42 · 2009-08-13T19:59:04.000Z
diff --git a/Lib/test/test_pyexpat.py b/Lib/test/test_pyexpat.py
@@ -510,6 +510,24 @@ def test_change_size_2(self):
         parser.Parse(xml2, 1)
         self.assertEquals(self.n, 4)
 
+class MalformedInputText(unittest.TestCase):
+    def test1(self):
+        xml = "\0\r\n"
+        parser = expat.ParserCreate()
+        try:
+            parser.Parse(xml, True)
+            self.fail()
+        except expat.ExpatError as e:
+            self.assertEquals(str(e), 'no element found: line 2, column 1')
+
+    def test2(self):
+        xml = "<?xml version\xc2\x85='1.0'?>\r\n"
+        parser = expat.ParserCreate()
+        try:
+            parser.Parse(xml, True)
+            self.fail()
+        except expat.ExpatError as e:
+            self.assertEquals(str(e), 'XML declaration not well-formed: line 1, column 14')
 
 def test_main():
     run_unittest(SetAttributeTest,
@@ -520,7 +538,8 @@ def test_main():
                  HandlerExceptionTest,
                  PositionTest,
                  sf1296433Test,
-                 ChardataBufferTest)
+                 ChardataBufferTest,
+                 MalformedInputText)
 
 if __name__ == "__main__":
     test_main()
diff --git a/Misc/NEWS b/Misc/NEWS
@@ -105,6 +105,8 @@ syntax error.
 Extension Modules
 -----------------
 
+- Fix a segfault in expat.
+
 - Issue #4509: array.array objects are no longer modified after an operation
   failing due to the resize restriction in-place when the object has exported
   buffers.
diff --git a/Modules/expat/xmltok_impl.c b/Modules/expat/xmltok_impl.c
@@ -1741,7 +1741,7 @@ PREFIX(updatePosition)(const ENCODING *enc,
                        const char *end,
                        POSITION *pos)
 {
-  while (ptr != end) {
+  while (ptr < end) {
     switch (BYTE_TYPE(enc, ptr)) {
 #define LEAD_CASE(n) \
     case BT_LEAD ## n: \

Original file line number	Diff line number	Diff line change
`@@ -1741,7 +1741,7 @@ PREFIX(updatePosition)(const ENCODING *enc,`
`1741`	`1741`	`const char *end,`
`1742`	`1742`	`POSITION *pos)`
`1743`	`1743`	`{`
`1744`		`- while (ptr != end) {`
	`1744`	`+ while (ptr < end) {`
`1745`	`1745`	`switch (BYTE_TYPE(enc, ptr)) {`
`1746`	`1746`	`#define LEAD_CASE(n) \`
`1747`	`1747`	`case BT_LEAD ## n: \`