gh-156939: Fix xmlcharrefreplace() buffer overflow (GH-157109)

Write into a temporary buffer to not write the trailing NUL byte
into the writer. Previously, the NUL byte was written outsize
the writer buffer.
(cherry picked from commit 9398655)

Co-authored-by: Victor Stinner <vstinner@python.org>

Author: vstinner

Objects/unicodeobject.c

@@ -961,10 +961,16 @@ xmlcharrefreplace(_PyBytesWriter *writer, char *str,
 
     /* generate replacement */
     for (i = collstart; i < collend; ++i) {
-        size = sprintf(str, "&#%d;", PyUnicode_READ(kind, data, i));
-        if (size < 0) {
-            return NULL;
-        }
+        // Use snprintf() with a temporary buffer to not write the trailing
+        // NUL byte in the writer buffer.
+        Py_BUILD_ASSERT(_Py_MAX_UNICODE <= 0x10ffff);
+        // len('&#1114111;\0') is 11 bytes.
+        char buffer[11];
+        Py_UCS4 ch = PyUnicode_READ(kind, data, i);
+        size = snprintf(buffer, sizeof(buffer), "&#%d;", ch);
+        assert(4 <= size && (size_t)size <= (sizeof(buffer) - 1));
+
+        memcpy(str, buffer, size);
         str += size;
     }
     return str;