Mercurial > cpython-lru_cache-weakref
diff Objects/stringobject.c @ 25720:3c26ae61e952 2.2
Backport stringobject.c 2.194 and unicodeobject.c 2.172:
Fix a nasty endcase reported by Armin Rigo in SF bug 618623:
'%2147483647d' % -123 segfaults. This was because an integer overflow
in a comparison caused the string resize to be skipped. After fixing
the overflow, this could call _PyString_Resize() with a negative size,
so I (1) test for that and raise MemoryError instead; (2) also added a
test for negative newsize to _PyString_Resize(), raising SystemError
as for all bad arguments.
An identical bug existed in unicodeobject.c, of course.
| author | Guido van Rossum <guido@python.org> |
|---|---|
| date | Fri, 11 Oct 2002 00:47:20 +0000 |
| parents | 55b18394123b |
| children | b30fe4dcc697 |
line wrap: on
line diff
--- a/Objects/stringobject.c Fri Oct 11 00:22:22 2002 +0000 +++ b/Objects/stringobject.c Fri Oct 11 00:47:20 2002 +0000 @@ -2988,7 +2988,7 @@ register PyObject *v; register PyStringObject *sv; v = *pv; - if (!PyString_Check(v) || v->ob_refcnt != 1) { + if (!PyString_Check(v) || v->ob_refcnt != 1 || newsize < 0) { *pv = 0; Py_DECREF(v); PyErr_BadInternalCall(); @@ -3600,10 +3600,14 @@ } if (width < len) width = len; - if (rescnt < width + (sign != 0)) { + if (rescnt - (sign != 0) < width) { reslen -= rescnt; rescnt = width + fmtcnt + 100; reslen += rescnt; + if (reslen < 0) { + Py_DECREF(result); + return PyErr_NoMemory(); + } if (_PyString_Resize(&result, reslen) < 0) return NULL; res = PyString_AS_STRING(result)