gh-156939: Fix xmlcharrefreplace() buffer overflow

Write into a temporay buffer to not write the trailing NUL byte.

Author: vstinner

Objects/unicodeobject.c

@@ -879,10 +879,16 @@ xmlcharrefreplace(PyBytesWriter *writer, char *str,
 
     /* generate replacement */
     for (i = collstart; i < collend; ++i) {
-        size = sprintf(str, "&#%d;", PyUnicode_READ(kind, data, i));
-        if (size < 0) {
-            return NULL;
-        }
+        // len('&#1114111;\0') is 11 bytes
+        Py_BUILD_ASSERT(_Py_MAX_UNICODE <= 0x10ffff);
+        char buffer[11];
+        Py_UCS4 ch = PyUnicode_READ(kind, data, i);
+        size = snprintf(buffer, sizeof(buffer), "&#%d;", ch);
+        assert(5 <= size && (size_t)size <= (sizeof(buffer) - 1));
+
+        // Use snprintf() to write into a temporary buffer to not write
+        // the trailing NUL byte
+        memcpy(str, buffer, size);
         str += size;
     }
     return str;