gh-160187: Reject ISO-2022 designations into the wrong G set

The ISO-2022 decoders checked only that a designated charset belonged to
the encoding, not that it went to the code element the encoding assigns
it to.

Author: gpshead

Lib/test/test_codecencodings_iso2022.py

@@ -15,13 +15,25 @@ class Test_ISO2022_JP(multibytecodec_support.TestBase, unittest.TestCase):
     tstring = multibytecodec_support.load_teststring('iso2022_jp')
     codectests = COMMON_CODEC_TESTS + (
         (b'ab\x1BNdef', 'replace', 'ab\x1BNdef'),
+        # there is no G1 in this encoding
+        (b'ab\x1B$)Bdef', 'strict', None),
+        (b'ab\x1B)Jdef', 'strict', None),
+        (b'ab\x1B)Bdef', 'strict', None),
     )
 
 class Test_ISO2022_JP2(multibytecodec_support.TestBase, unittest.TestCase):
     encoding = 'iso2022_jp_2'
     tstring = multibytecodec_support.load_teststring('iso2022_jp')
     codectests = COMMON_CODEC_TESTS + (
         (b'ab\x1BNdef', 'replace', 'abdef'),
+        # a charset can only be designated to its own plane
+        (b'\x1B.A\x1BNi', 'strict', '\xe9'),
+        (b'\x1B$(C\x30\x21\x1B(B', 'strict', '\uac00'),
+        (b'ab\x1B(Adef', 'strict', None),
+        (b'ab\x1B(Fdef', 'strict', None),
+        (b'ab\x1B.J\x1BNdef', 'strict', None),
+        (b'ab\x1B.Bdef', 'strict', None),
+        (b'ab\x1B$)Cdef', 'strict', None),
     )
 
 class Test_ISO2022_JP3(multibytecodec_support.TestBase, unittest.TestCase):
@@ -75,6 +87,12 @@ class Test_ISO2022_KR(multibytecodec_support.TestBase, unittest.TestCase):
     tstring = multibytecodec_support.load_teststring('iso2022_kr')
     codectests = COMMON_CODEC_TESTS + (
         (b'ab\x1BNdef', 'replace', 'ab\x1BNdef'),
+        # KS X 1001 can only be designated to G1
+        (b'\x1B$)C\x0E\x30\x21\x0Fdef', 'strict', '\uac00def'),
+        (b'ab\x1B$(Cdefg', 'strict', None),
+        (b'ab\x1B$Cdefg', 'strict', None),
+        (b'ab\x1B)Bdefg', 'strict', None),
+        (b'ab\x1B$(Cdefg', 'replace', 'ab\ufffddefg'),
     )
 
     # iso2022_kr.txt cannot be used to test "chunk coding": the escape

Misc/NEWS.d/next/Library/2026-10-22-00-30-04.gh-issue-160187.9dcj2B.rst

@@ -0,0 +1,6 @@
+The ISO-2022 decoders in :mod:`codecs` (``iso2022_jp``, ``iso2022_kr`` and
+related) now reject an escape sequence that designates a character set to a
+code element (G0, G1 or G2) the encoding does not assign it to.  Previously
+such sequences could make ``iso2022_kr`` decode ASCII as Korean text, or make
+``iso2022_jp_2`` raise :exc:`RuntimeError` instead of
+:exc:`UnicodeDecodeError`.

Modules/cjkcodecs/_codecs_iso2022.c

@@ -382,17 +382,22 @@ iso2022processesc(const MultibyteCodec *codec, MultibyteCodec_State *state,
         return esclen;
     }
 
-    /* raise error when the charset is not designated for this encoding */
+    /* raise error when the charset is not designated to this plane for
+     * this encoding (ASCII is only ever designated to G0) */
     if (charset != CHARSET_ASCII) {
         const struct iso2022_designation *dsg;
 
         for (dsg = CONFIG_DESIGNATIONS; dsg->mark; dsg++) {
-            if (dsg->mark == charset)
+            if (dsg->mark == charset && dsg->plane == designation) {
                 break;
+            }
         }
         if (!dsg->mark)
             return esclen;
     }
+    else if (designation != 0) {
+        return esclen;
+    }
 
     STATE_SETG(designation, charset);
     *inleft -= esclen;