AIKIDO-2026-988515

TL;DR

The C extension decoder in pygeohash.cgeohash.geohash_module indexes a fixed 128-entry base32_decode_map table using each input byte cast to a signed int. When a geohash string contains a byte >= 128 (for example multibyte UTF-8), that cast produces a negative index and the decoder reads outside the lookup table. The out-of-bounds read can yield incorrect decode results and, depending on process memory layout, undefined behavior. The fix casts each character to unsigned char and rejects any byte >= 128 with ValueError("Invalid character in geohash") before the table lookup.