Issue #16411: Fix a bug where zlib.decompressobj().flush() might try to access previously-freed memory.

Patch by Serhiy Storchaka.

1 files changed, 2 insertions, 2 deletions

diff --git a/Python/codecs.c b/Python/codecs.c
index fd67d1b9e1..37ae41b1ca 100644
--- a/Python/codecs.c
+++ b/Python/codecs.c
@@ -761,7 +761,7 @@ PyCodec_SurrogatePassErrors(PyObject *exc)
         for (i = start; i < end; i++) {
             /* object is guaranteed to be "ready" */
             Py_UCS4 ch = PyUnicode_READ_CHAR(object, i);
-            if (ch < 0xd800 || ch > 0xdfff) {
+            if (!Py_UNICODE_IS_SURROGATE(ch)) {
                 /* Not a surrogate, fail with original exception */
                 PyErr_SetObject(PyExceptionInstance_Class(exc), exc);
                 Py_DECREF(res);
@@ -797,7 +797,7 @@ PyCodec_SurrogatePassErrors(PyObject *exc)
             (p[2] & 0xc0) == 0x80) {
             /* it's a three-byte code */
             ch = ((p[0] & 0x0f) << 12) + ((p[1] & 0x3f) << 6) + (p[2] & 0x3f);
-            if (ch < 0xd800 || ch > 0xdfff)
+            if (!Py_UNICODE_IS_SURROGATE(ch))
                 /* it's not a surrogate - fail */
                 ch = 0;
         }