Code: log2vis_unicode (PyObject * unicode, FriBidiParType base_direction, int clean, int reordernsm)
 {
	PyObject *logical = NULL;	/* input string encoded in utf-8 */
	PyObject *visual = NULL;	/* output string encoded in utf-8 */
	PyObject *result = NULL;	/* unicode output string */
	int length = PyUnicode_GET_SIZE (unicode);
	logical = PyUnicode_AsUTF8String (unicode);
	if (logical == NULL)
		goto cleanup;
	visual = log2vis_utf8 (logical, length, base_direction, clean, reordernsm);
	if (visual == NULL)
		goto cleanup;
	result = PyUnicode_DecodeUTF8 (PyString_AS_STRING (visual),
				       PyString_GET_SIZE (visual), "strict");
      cleanup:
	Py_XDECREF (logical);
	Py_XDECREF (visual);
	return result;
 }

Vulnerability Type: DoS Overflow 
CWE ID: CWE-119
Summary: Buffer overflow in the fribidi_utf8_to_unicode function in PyFriBidi before 0.11.0 allows remote attackers to cause a denial of service (application crash) via a 4-byte utf-8 sequence.
Commit Message: refactor pyfribidi.c module

pyfribidi.c is now compiled as _pyfribidi. This module only handles
unicode internally and doesn't use the fribidi_utf8_to_unicode
function (which can't handle 4 byte utf-8 sequences). This fixes the
buffer overflow in issue #2.

The code is now also much simpler: pyfribidi.c is down from 280 to 130
lines of code.

We now ship a pure python pyfribidi that handles the case when
non-unicode strings are passed in.

We now also adapt the size of the output string if clean=True is
passed.