Skip to content

array: unpickling an odd-length 'w' array across endianness raises ValueError (wrong UTF-16/UTF-32 item size) #155850

Description

@tonghuaroot

Bug report

array.array pickles carry a machine-format code so the receiver can decode
data from a different platform. The decoder's format table
(mformat_descriptors in Modules/arraymodule.c) stores a wrong item size
for the Unicode formats: UTF-16 entries say 4 bytes per item (actual: 2) and
UTF-32 entries say 8 (actual: 4).

The only consumer of that field is the length check on the cross-endian slow
path, so unpickling an odd-length 'w' array from a machine of the opposite
endianness fails:

import array
recon = array._array_reconstructor  # what pickle calls
data = 'abc'.encode('utf-32-be')    # 3 code points, big-endian
recon(array.array, 'w', 21, data)   # 21 = UTF32_BE, on a little-endian machine
# ValueError: string length not a multiple of item size

Even lengths decode correctly, and same-endian pickles use the fast path that
skips the check, which is why this stayed hidden. On 3.13/3.14 the 'u'
typecode maps to the (equally wrong) UTF-16 entries on Windows.

Linked PRs

Metadata

Metadata

Assignees

No one assigned

    Labels

    extension-modulesC modules in the Modules dirtype-bugAn unexpected behavior, bug, or error

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions