gh-160717: Make euc_kr decoding round-trip for KS X 1001 syllables

Lib/test/test_codecencodings_kr.py

@@ -47,8 +47,34 @@ class Test_EUCKR(multibytecodec_support.TestBase, unittest.TestCase):
         (b"\xa4\xd4\xa4\xb6\xa4\xd0\xa4\xff", "replace", '\ufffd\u6e21\ub544\u572d\ufffd'),
         (b"\xa4\xd4\xff\xa4\xd4\xa4\xb6\xa4\xd0\xa4\xd4", "replace", '\ufffd\ufffd\ufffd\uc4d4'),
         (b"\xc1\xc4", "strict", "\uc894"),
+
+        # make-up sequences for syllables that KS X 1001 encodes directly
+        (b"\xa4\xd4\xa4\xa1\xa4\xbf\xa4\xd4", "strict", None),
+        (b"\xa4\xd4\xa4\xa1\xa4\xbf\xa4\xd4", "replace", "\ufffd"),
+        (b"\xa4\xd4\xa4\xa1\xa4\xbf\xa4\xd4x", "ignore", "x"),
+        (b"\xa4\xd4\xa4\xa1\xa4\xbf\xa4\xd4x", "replace", "\ufffdx"),
+        (b"\xa4\xd4\xa4\xbe\xa4\xd3\xa4\xbe", "strict", "\ud7a3"),
     )
 
+    def test_makeup_sequence_roundtrip(self):
+        accepted = 0
+        for cho in range(0xa1, 0xd5):
+            for jung in range(0xa1, 0xd5):
+                for jong in range(0xa1, 0xd5):
+                    b = bytes([0xa4, 0xd4, 0xa4, cho, 0xa4, jung, 0xa4, jong])
+                    with self.subTest(b=b):
+                        try:
+                            s = b.decode('euc_kr')
+                        except UnicodeDecodeError:
+                            s = b.decode('euc_kr', 'surrogateescape')
+                            self.assertEqual(s.encode('euc_kr', 'surrogateescape'), b)
+                            continue
+                        accepted += 1
+                        self.assertEqual(s.encode('euc_kr'), b)
+        # Of the 11172 Hangul syllables, KS X 1001 encodes 2350 in 2 bytes;
+        # only the rest may be written as make-up sequences.
+        self.assertEqual(accepted, 11172 - 2350)
+
 class Test_JOHAB(multibytecodec_support.TestBase, unittest.TestCase):
     encoding = 'johab'
     tstring = multibytecodec_support.load_teststring('johab')

Misc/NEWS.d/next/Security/2026-10-22-19-28-11.gh-issue-160717.euckr1.rst

@@ -0,0 +1,9 @@
+.. cve: CVE-2026-115514
+
+Fix the EUC-KR decoder to reject the 8-byte Hangul make-up sequence for
+syllables that KS X 1001 encodes in 2 bytes. Previously such input decoded
+to a string that re-encoded to different bytes, so on hosts using EUC-KR as
+the filesystem encoding a path or symlink target read from disk could resolve
+differently in Python than in the operating system. In particular, this
+allowed the :mod:`tarfile` extraction filters to approve a symlink chain that
+leads outside the destination directory.

Modules/cjkcodecs/_codecs_kr.c

@@ -121,7 +121,7 @@ DECODER(euc_kr)
         if (c == EUCKR_JAMO_FIRSTBYTE &&
             INBYTE2 == EUCKR_JAMO_FILLER) {
             /* KS X 1001:1998 make-up sequence */
-            DBCHAR cho, jung, jong;
+            DBCHAR cho, jung, jong, code;
 
             REQUIRE_INBUF(8);
             if ((*inbuf)[2] != EUCKR_JAMO_FIRSTBYTE ||
@@ -149,7 +149,14 @@ DECODER(euc_kr)
             if (cho == NONE || jung == NONE || jong == NONE)
                 return 1;
 
-            OUTCHAR(0xac00 + cho*588 + jung*28 + jong);
+            decoded = 0xac00 + cho*588 + jung*28 + jong;
+            /* Reject syllables in KS X 1001; the encoder writes those as
+               2 bytes, so the sequence would not round-trip. */
+            if (!TRYMAP_ENC(cp949, code, decoded) || (code & 0x8000) == 0) {
+                return 8;
+            }
+
+            OUTCHAR(decoded);
             NEXT_IN(8);
         }
         else if (TRYMAP_DEC(ksx1001, decoded, c ^ 0x80, INBYTE2 ^ 0x80)) {