gh-156939: Fix xmlcharrefreplace() buffer overflow

Write into a temporay buffer to not write the trailing NUL byte.

Author: vstinner

Misc/NEWS.d/next/Security/2026-09-07-22-28-21.gh-issue-156939.aqV_OH.rst

@@ -0,0 +1,4 @@
+Fix a buffer overflow the ``xmlcharrefreplace`` error handler of 8-bit
+encoding (such as ``ascii`` and ``latin1``). Previously, a buffer overflow
+of one NUL byte was written in the stack memory if the output length was
+exactly 512 bytes. Patch by Victor Stinner.

Misc/NEWS.d/next/Security/2026-09-07-22-32-49.gh-issue-156939.vXc73v.rst

@@ -0,0 +1,4 @@
+Fix a buffer overflow in the ``xmlcharrefreplace`` error handler of 8-bit
+encoding (such as ``ascii`` and ``latin1``). Previously, a buffer overflow
+wrote one NUL byte in the stack memory if the output length was exactly 512
+bytes. Patch by Victor Stinner.

Objects/unicodeobject.c

@@ -879,10 +879,16 @@ xmlcharrefreplace(PyBytesWriter *writer, char *str,
 
     /* generate replacement */
     for (i = collstart; i < collend; ++i) {
-        size = sprintf(str, "&#%d;", PyUnicode_READ(kind, data, i));
-        if (size < 0) {
-            return NULL;
-        }
+        // Use snprintf() with a temporary buffer to not write the trailing
+        // NUL byte in the writer buffer.
+        Py_BUILD_ASSERT(_Py_MAX_UNICODE <= 0x10ffff);
+        // len('&#1114111;\0') is 11 bytes.
+        char buffer[11];
+        Py_UCS4 ch = PyUnicode_READ(kind, data, i);
+        size = snprintf(buffer, sizeof(buffer), "&#%d;", ch);
+        assert(5 <= size && (size_t)size <= (sizeof(buffer) - 1));
+
+        memcpy(str, buffer, size);
         str += size;
     }
     return str;