traverseda
/
cpython
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Issue #14700: Fix buggy overflow checks for large precision and width in new-style and old-style formatting.

This commit is contained in:
Mark Dickinson 2012-10-28 10:00:46 +00:00
parent 08114d40e9
commit 75d3600466
7 changed files with 74 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
Lib/test/test_str.py
View File

@ -35,6 +35,18 @@ class StrTest(
string_tests.MixinStrUnicodeUserStringTest.test_formatting(self)
self.assertRaises(OverflowError, '%c'.__mod__, 0x1234)
@test_support.cpython_only
def test_formatting_huge_precision(self):
from _testcapi import INT_MAX
format_string = "%.{}f".format(INT_MAX + 1)
with self.assertRaises(ValueError):
result = format_string % 2.34
def test_formatting_huge_width(self):
format_string = "%{}f".format(sys.maxsize + 1)
with self.assertRaises(ValueError):
result = format_string % 2.34
def test_conversion(self):
# Make sure __str__() behaves properly
class Foo0:
@ -371,6 +383,21 @@ class StrTest(
self.assertRaises(ValueError, format, "", "-")
self.assertRaises(ValueError, "{0:=s}".format, '')
def test_format_huge_precision(self):
format_string = ".{}f".format(sys.maxsize + 1)
with self.assertRaises(ValueError):
result = format(2.34, format_string)
def test_format_huge_width(self):
format_string = "{}f".format(sys.maxsize + 1)
with self.assertRaises(ValueError):
result = format(2.34, format_string)
def test_format_huge_item_number(self):
format_string = "{{{}:.6f}}".format(sys.maxsize + 1)
with self.assertRaises(ValueError):
result = format_string.format(2.34)
def test_format_auto_numbering(self):
class C:
def __init__(self, x=100):

27
Lib/test/test_unicode.py
View File

@ -644,6 +644,18 @@ class UnicodeTest(
return u'\u1234'
self.assertEqual('%s' % Wrapper(), u'\u1234')
@test_support.cpython_only
def test_formatting_huge_precision(self):
from _testcapi import INT_MAX
format_string = u"%.{}f".format(INT_MAX + 1)
with self.assertRaises(ValueError):
result = format_string % 2.34
def test_formatting_huge_width(self):
format_string = u"%{}f".format(sys.maxsize + 1)
with self.assertRaises(ValueError):
result = format_string % 2.34
def test_startswith_endswith_errors(self):
for meth in (u'foo'.startswith, u'foo'.endswith):
with self.assertRaises(UnicodeDecodeError):
@ -1556,6 +1568,21 @@ class UnicodeTest(
# will fail
self.assertRaises(UnicodeEncodeError, "foo{0}".format, u'\u1000bar')
def test_format_huge_precision(self):
format_string = u".{}f".format(sys.maxsize + 1)
with self.assertRaises(ValueError):
result = format(2.34, format_string)
def test_format_huge_width(self):
format_string = u"{}f".format(sys.maxsize + 1)
with self.assertRaises(ValueError):
result = format(2.34, format_string)
def test_format_huge_item_number(self):
format_string = u"{{{}:.6f}}".format(sys.maxsize + 1)
with self.assertRaises(ValueError):
result = format_string.format(2.34)
def test_format_auto_numbering(self):
class C:
def __init__(self, x=100):

3
Misc/NEWS
View File

@ -9,6 +9,9 @@ What's New in Python 2.7.4
Core and Builtins
-----------------
- Issue #14700: Fix buggy overflow checks for large width and precision
in string formatting operations.
- Issue #6074: Ensure cached bytecode files can always be updated by the
user that created them, even when the source file is read-only.

16
Objects/stringlib/formatter.h
View File

@ -73,7 +73,7 @@ static int
get_integer(STRINGLIB_CHAR **ptr, STRINGLIB_CHAR *end,
Py_ssize_t *result)
{
Py_ssize_t accumulator, digitval, oldaccumulator;
Py_ssize_t accumulator, digitval;
int numdigits;
accumulator = numdigits = 0;
for (;;(*ptr)++, numdigits++) {
@ -83,19 +83,17 @@ get_integer(STRINGLIB_CHAR **ptr, STRINGLIB_CHAR *end,
if (digitval < 0)
break;
/*
This trick was copied from old Unicode format code. It's cute,
but would really suck on an old machine with a slow divide
implementation. Fortunately, in the normal case we do not
expect too many digits.
Detect possible overflow before it happens:
accumulator * 10 + digitval > PY_SSIZE_T_MAX if and only if
accumulator > (PY_SSIZE_T_MAX - digitval) / 10.
*/
oldaccumulator = accumulator;
accumulator *= 10;
if ((accumulator+10)/10 != oldaccumulator+1) {
if (accumulator > (PY_SSIZE_T_MAX - digitval) / 10) {
PyErr_Format(PyExc_ValueError,
"Too many decimal digits in format string");
return -1;
}
accumulator += digitval;
accumulator = accumulator * 10 + digitval;
}
*result = accumulator;
return numdigits;

15
Objects/stringlib/string_format.h
View File

@ -197,7 +197,6 @@ get_integer(const SubString *str)
{
Py_ssize_t accumulator = 0;
Py_ssize_t digitval;
Py_ssize_t oldaccumulator;
STRINGLIB_CHAR *p;
/* empty string is an error */
@ -209,19 +208,17 @@ get_integer(const SubString *str)
if (digitval < 0)
return -1;
/*
This trick was copied from old Unicode format code. It's cute,
but would really suck on an old machine with a slow divide
implementation. Fortunately, in the normal case we do not
expect too many digits.
Detect possible overflow before it happens:
accumulator * 10 + digitval > PY_SSIZE_T_MAX if and only if
accumulator > (PY_SSIZE_T_MAX - digitval) / 10.
*/
oldaccumulator = accumulator;
accumulator *= 10;
if ((accumulator+10)/10 != oldaccumulator+1) {
if (accumulator > (PY_SSIZE_T_MAX - digitval) / 10) {
PyErr_Format(PyExc_ValueError,
"Too many decimal digits in format string");
return -1;
}
accumulator += digitval;
accumulator = accumulator * 10 + digitval;
}
return accumulator;
}

4
Objects/stringobject.c
View File

@ -4369,7 +4369,7 @@ PyString_Format(PyObject *format, PyObject *args)
c = Py_CHARMASK(*fmt++);
if (!isdigit(c))
break;
if ((width*10) / 10 != width) {
if (width > (PY_SSIZE_T_MAX - ((int)c - '0')) / 10) {
PyErr_SetString(
PyExc_ValueError,
"width too big");
@ -4404,7 +4404,7 @@ PyString_Format(PyObject *format, PyObject *args)
c = Py_CHARMASK(*fmt++);
if (!isdigit(c))
break;
if ((prec*10) / 10 != prec) {
if (prec > (INT_MAX - ((int)c - '0')) / 10) {
PyErr_SetString(
PyExc_ValueError,
"prec too big");

4
Objects/unicodeobject.c
View File

@ -8394,7 +8394,7 @@ PyObject *PyUnicode_Format(PyObject *format,
c = *fmt++;
if (c < '0' || c > '9')
break;
if ((width*10) / 10 != width) {
if (width > (PY_SSIZE_T_MAX - ((int)c - '0')) / 10) {
PyErr_SetString(PyExc_ValueError,
"width too big");
goto onError;
@ -8427,7 +8427,7 @@ PyObject *PyUnicode_Format(PyObject *format,
c = *fmt++;
if (c < '0' || c > '9')
break;
if ((prec*10) / 10 != prec) {
if (prec > (INT_MAX - ((int)c - '0')) / 10) {
PyErr_SetString(PyExc_ValueError,
"prec too big");
goto onError;