mirrors/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2025-07-15 15:25:29 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 9

Issue #14700: Fix two broken and undefined-behaviour-inducing overflow checks in old-style string formatting. Thanks Serhiy Storchaka for report and original patch.

Browse source
This commit is contained in:
Mark Dickinson 2012-05-07 11:20:50 +01:00
parent 10ba07a39e
commit 99e2e5552a
3 changed files with 9 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
Objects/unicodeobject.c
View file

@ -13933,7 +13933,7 @@ PyUnicode_Format(PyObject *format, PyObject *args)
c = PyUnicode_READ(fmtkind, fmt, fmtpos++);
if (c < '0' || c > '9')
break;
if ((width*10) / 10 != width) {
if (width > (PY_SSIZE_T_MAX - (c - '0')) / 10) {
PyErr_SetString(PyExc_ValueError,
"width too big");
goto onError;
@ -13968,7 +13968,7 @@ PyUnicode_Format(PyObject *format, PyObject *args)
c = PyUnicode_READ(fmtkind, fmt, fmtpos++);
if (c < '0' || c > '9')
break;
if ((prec*10) / 10 != prec) {
if (prec > (INT_MAX - (c - '0')) / 10) {
PyErr_SetString(PyExc_ValueError,
"prec too big");
goto onError;