Incorrect handling of `start` and `end` values in `codecs` error handlers

[picnixz]

Crash report

What happened?

./python -c "import codecs; codecs.xmlcharrefreplace_errors(UnicodeEncodeError('bad', '', 0, 1, 'reason'))"
python: ./Include/cpython/unicodeobject.h:339: PyUnicode_READ_CHAR: Assertion `index >= 0' failed.
Aborted (core dumped)

./python -c "import codecs; codecs.backslashreplace_errors(UnicodeDecodeError('utf-8', b'00000', 9, 2, 'reason'))"
Traceback (most recent call last):
  File "<string>", line 1, in <module>
SystemError: Negative size passed to PyUnicode_New

./python -c "import codecs; codecs.replace_errors(UnicodeTranslateError('000', 1, -7, 'reason'))"
python: Python/codecs.c:743: PyCodec_ReplaceErrors: Assertion `PyUnicode_KIND(res) == PyUnicode_2BYTE_KIND' failed.
Aborted (core dumped)

See #123378 for the root cause. Since we are still wondering how to fix the getters and setters, I suggest we first fix the crash by adding the checks inside at the handler's level (for now). I'm not sure if the handler itself is handling corner cases correctly as well.

Linked PRs

• gh-126004: remove redundant safeguards for codecs handlers tests #127680
• gh-126004: fix positions handling in codecs.replace_errors #127674
• gh-126004: fix positions handling in codecs.xmlcharrefreplace_errors #127675
• gh-126004: fix positions handling in codecs.backslashreplace_errors #127676

[picnixz]

FTR: I prepared three branches that fix (and cleanup) the error handlers.

Those branches include #123380 and thus I'll wait for the latter to be merged since otherwise there will be a crash even before the actual "bad" code happens.

The fixes are actually quite straightforward: there is actually no check on the consistency of start and end after they've been retrieved via *GetStart and *GetEnd, and this leads to OOB issues or other kind of issues. So, even if we fix the getters, we still need to handle the consistency of the bounds.

cc @encukou

[picnixz]

Since #123378 is only 3.14+ (not backported), the fixes for those handlers will also be 3.14+ only.