Mirror
/
cpython
mirror of https://github.com/python/cpython
4
1
Fork 0
Code Issues Releases Wiki Activity

bpo-35552: Fix reading past the end in PyUnicode_FromFormat() and PyBytes_FromFormat(). (GH-11276) 

Format characters "%s" and "%V" in PyUnicode_FromFormat() and "%s" in PyBytes_FromFormat()
no longer read memory past the limit if precision is specified.
This commit is contained in:
Serhiy Storchaka 2019-01-12 10:30:35 +02:00 committed by GitHub
parent f1ec3cefad
commit d586ccb04f
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 21 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
Misc/NEWS.d/next/Core and Builtins/2018-12-21-13-29-30.bpo-35552.1DzQQc.rst Normal file
View File

@ -0,0 +1,3 @@
Format characters ``%s`` and ``%V`` in :c:func:`PyUnicode_FromFormat` and
``%s`` in :c:func:`PyBytes_FromFormat` no longer read memory past the
limit if *precision* is specified.

10
Objects/bytesobject.c
View File

@ -312,9 +312,15 @@ PyBytes_FromFormatV(const char *format, va_list vargs)
Py_ssize_t i;
p = va_arg(vargs, const char*);
if (prec <= 0) {
i = strlen(p);
if (prec > 0 && i > prec)
i = prec;
}
else {
i = 0;
while (i < prec && p[i]) {
i++;
}
}
s = _PyBytesWriter_WriteBytes(&writer, s, p, i);
if (s == NULL)
goto error;

10
Objects/unicodeobject.c
View File

@ -2578,9 +2578,15 @@ unicode_fromformat_write_cstr(_PyUnicodeWriter *writer, const char *str,
PyObject *unicode;
int res;
if (precision == -1) {
length = strlen(str);
if (precision != -1)
length = Py_MIN(length, precision);
}
else {
length = 0;
while (length < precision && str[length]) {
length++;
}
}
unicode = PyUnicode_DecodeUTF8Stateful(str, length, "replace", NULL);
if (unicode == NULL)
return -1;