Out-of-bounds read in the ISO-2022 decoder for an unknown charset

[tonghuaroot]

Bug report

Bug description:

The C implementation of the ISO-2022 decoders scans a designation table for the
charset held in the decoder state, but the loop's terminator is compiled only
under Py_DEBUG. On a release build, decoding after an unknown charset is set
via setstate() walks off the table (an out-of-bounds read) and dereferences a
garbage function pointer.

import codecs
d = codecs.getincrementaldecoder("iso-2022-jp")()
d.setstate((b"", 0xff))
d.decode(b"!", final=True) # out-of-bounds read / crash

CPython versions tested on:

3.13, 3.14, 3.15, 3.16

Operating systems tested on:

macOS

Linked PRs

• gh-153603: Fix out-of-bounds read in the ISO-2022 decoder for an unknown charset #153604