Code: log2vis_encoded_string (PyObject * string, const char *encoding,
			FriBidiParType base_direction, int clean, int reordernsm)
{
	PyObject *logical = NULL;	/* logical unicode object */
	PyObject *result = NULL;	/* output string object */
	/* Always needed for the string length */
	logical = PyUnicode_Decode (PyString_AS_STRING (string),
				    PyString_GET_SIZE (string),
				    encoding, "strict");
	if (logical == NULL)
		return NULL;
	if (strcmp (encoding, "utf-8") == 0)
		/* Shortcut for utf8 strings (little faster) */
		result = log2vis_utf8 (string,
				       PyUnicode_GET_SIZE (logical),
				       base_direction, clean, reordernsm);
	else
	{
		/* Invoke log2vis_unicode and encode back to encoding */
		PyObject *visual = log2vis_unicode (logical, base_direction, clean, reordernsm);
		if (visual)
		{
			result = PyUnicode_Encode (PyUnicode_AS_UNICODE
						   (visual),
						   PyUnicode_GET_SIZE (visual),
						   encoding, "strict");
			Py_DECREF (visual);
		}
	}
	Py_DECREF (logical);
	return result;
}

Vulnerability Type: DoS Overflow 
CWE ID: CWE-119
Summary: Buffer overflow in the fribidi_utf8_to_unicode function in PyFriBidi before 0.11.0 allows remote attackers to cause a denial of service (application crash) via a 4-byte utf-8 sequence.
Commit Message: refactor pyfribidi.c module

pyfribidi.c is now compiled as _pyfribidi. This module only handles
unicode internally and doesn't use the fribidi_utf8_to_unicode
function (which can't handle 4 byte utf-8 sequences). This fixes the
buffer overflow in issue #2.

The code is now also much simpler: pyfribidi.c is down from 280 to 130
lines of code.

We now ship a pure python pyfribidi that handles the case when
non-unicode strings are passed in.

We now also adapt the size of the output string if clean=True is
passed.