Fix segfault discovered by Ron Adam. Not checking for terminating right bracket in "'{0[}'.format(())". Fixed, and tests added.

This commit is contained in:
Eric Smith 2007-09-03 08:40:29 +00:00
parent f82d9b52fa
commit 4cb4e4e882
2 changed files with 12 additions and 4 deletions

View file

@ -458,6 +458,7 @@ class UnicodeTest(
# weird field names
self.assertEqual("{0[foo-bar]}".format({'foo-bar':'baz'}), 'baz')
self.assertEqual("{0[foo bar]}".format({'foo bar':'baz'}), 'baz')
self.assertEqual("{0[ ]}".format({' ':3}), '3')
self.assertEqual('{foo._x}'.format(foo=C(20)), '20')
self.assertEqual('{1}{0}'.format(D(10), D(20)), '2010')
@ -551,6 +552,7 @@ class UnicodeTest(
self.assertRaises(ValueError, "{0".format)
self.assertRaises(ValueError, "{0.}".format)
self.assertRaises(ValueError, "{0[}".format)
self.assertRaises(ValueError, "{0[}".format, [])
self.assertRaises(ValueError, "{0]}".format)
self.assertRaises(ValueError, "{0.[]}".format)
self.assertRaises(ValueError, "{0..foo}".format, 0)

View file

@ -273,6 +273,7 @@ _FieldNameIterator_attr(FieldNameIterator *self, SubString *name)
static int
_FieldNameIterator_item(FieldNameIterator *self, SubString *name)
{
int bracket_seen = 0;
STRINGLIB_CHAR c;
name->ptr = self->ptr;
@ -281,12 +282,19 @@ _FieldNameIterator_item(FieldNameIterator *self, SubString *name)
while (self->ptr < self->str.end) {
switch (c = *self->ptr++) {
case ']':
bracket_seen = 1;
break;
default:
continue;
}
break;
}
/* make sure we ended with a ']' */
if (!bracket_seen) {
PyErr_SetString(PyExc_ValueError, "Missing ']' in format string");
return 0;
}
/* end of string is okay */
/* don't include the ']' */
name->end = self->ptr-1;
@ -305,16 +313,14 @@ FieldNameIterator_next(FieldNameIterator *self, int *is_attribute,
switch (*self->ptr++) {
case '.':
*is_attribute = 1;
if (_FieldNameIterator_attr(self, name) == 0) {
if (_FieldNameIterator_attr(self, name) == 0)
return 0;
}
*name_idx = -1;
break;
case '[':
*is_attribute = 0;
if (_FieldNameIterator_item(self, name) == 0) {
if (_FieldNameIterator_item(self, name) == 0)
return 0;
}
*name_idx = get_integer(name);
break;
default: