diff Python/getargs.c @ 39189:17d5671fffcc legacy-trunk

Part of bug #1523610: fix miscalculation of buffer length. Also add a guard against NULL in converttuple and add a test case (that previously would have crashed).
author Georg Brandl <georg@python.org>
date Wed, 26 Jul 2006 08:03:10 +0000
parents e2ba5ae4b813
children 9d089aa58e2f
line wrap: on
line diff
--- a/Python/getargs.c	Wed Jul 26 07:40:17 2006 +0000
+++ b/Python/getargs.c	Wed Jul 26 08:03:10 2006 +0000
@@ -351,8 +351,8 @@
 				      "argument %d", iarg);
 			i = 0;
 			p += strlen(p);
-			while (levels[i] > 0 && (int)(p-buf) < 220) {
-				PyOS_snprintf(p, sizeof(buf) - (buf - p),
+			while (levels[i] > 0 && i < 32 && (int)(p-buf) < 220) {
+				PyOS_snprintf(p, sizeof(buf) - (p - buf),
 					      ", item %d", levels[i]-1);
 				p += strlen(p);
 				i++;
@@ -439,6 +439,13 @@
 		char *msg;
 		PyObject *item;
 		item = PySequence_GetItem(arg, i);
+		if (item == NULL) {
+			PyErr_Clear();
+			levels[0] = i+1;
+			levels[1] = 0;
+			strncpy(msgbuf, "is not retrievable", bufsize);
+			return msgbuf;
+		}
 		msg = convertitem(item, &format, p_va, flags, levels+1, 
 				  msgbuf, bufsize, freelist);
 		/* PySequence_GetItem calls tp->sq_item, which INCREFs */
@@ -1509,6 +1516,7 @@
 		else {
 			msg = skipitem(&format, p_va, flags);
 			if (msg) {
+				levels[0] = 0;
 				seterror(i+1, msg, levels, fname, message);
 				return cleanreturn(0, freelist);
 			}