From df6d7b406f3d1b2e4e2014751bfa25574c4df222 Mon Sep 17 00:00:00 2001
From: Xiang Zhang <angwerzx@126.com>
Date: Mon, 6 Mar 2017 18:17:10 +0800
Subject: [PATCH] [3.6] bpo-29714: Fix a regression that bytes format may fail
 when containing zero bytes inside. (GH-504)

---
 Lib/test/test_bytes.py | 10 ++++++++++
 Misc/NEWS              |  3 +++
 Objects/bytesobject.c  |  4 ++--
 3 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/Lib/test/test_bytes.py b/Lib/test/test_bytes.py
index a103a7d39ca..cd82fa64570 100644
--- a/Lib/test/test_bytes.py
+++ b/Lib/test/test_bytes.py
@@ -507,6 +507,11 @@ class BaseBytesTest:
         a = b % (b'seventy-nine', 79)
         self.assertEqual(a, b'seventy-nine / 100 = 79%')
         self.assertIs(type(a), self.type2test)
+        # issue 29714
+        b = self.type2test(b'hello,\x00%b!')
+        b = b % b'world'
+        self.assertEqual(b, b'hello,\x00world!')
+        self.assertIs(type(b), self.type2test)
 
     def test_imod(self):
         b = self.type2test(b'hello, %b!')
@@ -519,6 +524,11 @@ class BaseBytesTest:
         b %= (b'seventy-nine', 79)
         self.assertEqual(b, b'seventy-nine / 100 = 79%')
         self.assertIs(type(b), self.type2test)
+        # issue 29714
+        b = self.type2test(b'hello,\x00%b!')
+        b %= b'world'
+        self.assertEqual(b, b'hello,\x00world!')
+        self.assertIs(type(b), self.type2test)
 
     def test_rmod(self):
         with self.assertRaises(TypeError):
diff --git a/Misc/NEWS b/Misc/NEWS
index a1222985794..1fb78365bb8 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -10,6 +10,9 @@ What's New in Python 3.6.1 final?
 Core and Builtins
 -----------------
 
+- bpo-29714: Fix a regression that bytes format may fail when containing zero
+  bytes inside.
+
 Library
 -------
 
diff --git a/Objects/bytesobject.c b/Objects/bytesobject.c
index 5d484409600..801711f7e6c 100644
--- a/Objects/bytesobject.c
+++ b/Objects/bytesobject.c
@@ -619,11 +619,11 @@ _PyBytes_FormatEx(const char *format, Py_ssize_t format_len,
             Py_ssize_t len;
             char *pos;
 
-            pos = strchr(fmt + 1, '%');
+            pos = (char *)memchr(fmt + 1, '%', fmtcnt);
             if (pos != NULL)
                 len = pos - fmt;
             else
-                len = format_len - (fmt - format);
+                len = fmtcnt + 1;
             assert(len != 0);
 
             memcpy(res, fmt, len);