python - fix buffer overflows in unicode processing and elsewhere

Modules/arraymodule.c

 /* Array object implementation */
 
 /* An array is a uniform list -- all items have the same type.
    The item type is restricted to simple C types like int or float */
 
 #define PY_SSIZE_T_CLEAN
 #include "Python.h"
 #include "structmember.h"
 
 #ifdef STDC_HEADERS
@@ skipping 797 matching lines @@
         Py_DECREF(it);
         if (PyErr_Occurred())
                 return -1;
         return 0;
 }
 
 static int
 array_do_extend(arrayobject *self, PyObject *bb)
 {
         Py_ssize_t size;
+        char *old_item;
 
         if (!array_Check(bb))
                 return array_iter_extend(self, bb);
 #define b ((arrayobject *)bb)
         if (self->ob_descr != b->ob_descr) {
                 PyErr_SetString(PyExc_TypeError,
                              "can only extend with array of same kind");
                 return -1;
         }
         if ((Py_SIZE(self) > PY_SSIZE_T_MAX - Py_SIZE(b)) ||
                 ((Py_SIZE(self) + Py_SIZE(b)) > PY_SSIZE_T_MAX / self->ob_descr->itemsize)) {
                 PyErr_NoMemory();
                 return -1;
         }
         size = Py_SIZE(self) + Py_SIZE(b);
+        old_item = self->ob_item;
         PyMem_RESIZE(self->ob_item, char, size*self->ob_descr->itemsize);
         if (self->ob_item == NULL) {
+                self->ob_item = old_item;
                 PyErr_NoMemory();
                 return -1;
         }
         memcpy(self->ob_item + Py_SIZE(self)*self->ob_descr->itemsize,
                b->ob_item, Py_SIZE(b)*b->ob_descr->itemsize);
         Py_SIZE(self) = size;
         self->allocated = size;
 
         return 0;
 #undef b
@@ skipping 32 matching lines @@
                 if (n == 0) {
                         PyMem_FREE(items);
                         self->ob_item = NULL;
                         Py_SIZE(self) = 0;
                         self->allocated = 0;
                 }
                 else {
                         if (size > PY_SSIZE_T_MAX / n) {
                                 return PyErr_NoMemory();
                         }
-                        PyMem_Resize(items, char, n * size);
+                        PyMem_RESIZE(items, char, n * size);
                         if (items == NULL)
                                 return PyErr_NoMemory();
                         p = items;
                         for (i = 1; i < n; i++) {
                                 p += size;
                                 memcpy(p, items, size);
                         }
                         self->ob_item = items;
                         Py_SIZE(self) *= n;
                         self->allocated = Py_SIZE(self);
@@ skipping 1331 matching lines @@
         m = Py_InitModule3("array", a_methods, module_doc);
         if (m == NULL)
                 return;
 
         Py_INCREF((PyObject *)&Arraytype);
         PyModule_AddObject(m, "ArrayType", (PyObject *)&Arraytype);
         Py_INCREF((PyObject *)&Arraytype);
         PyModule_AddObject(m, "array", (PyObject *)&Arraytype);
         /* No need to check the error here, the caller will do that */
 }