Mercurial > cpython-lru_cache-weakref

diff Objects/unicodeobject.c @ 79543:d1369daeb9ec

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Issue #16147: PyUnicode_FromFormatV() now detects integer overflow when parsing width and precision
author Victor Stinner <victor.stinner@gmail.com>
date Sat, 06 Oct 2012 23:05:00 +0200
parents b4bee17625e1
children 5e319fdab563
line wrap: on
line diff
--- a/Objects/unicodeobject.c	Sat Oct 06 23:03:36 2012 +0200
+++ b/Objects/unicodeobject.c	Sat Oct 06 23:05:00 2012 +0200
@@ -2357,6 +2357,11 @@
     /* parse the width.precision part, e.g. "%2.5s" => width=2, precision=5 */
     width = 0;
     while (Py_ISDIGIT((unsigned)*f)) {
+        if (width > (INT_MAX - ((int)*f - '0')) / 10) {
+            PyErr_SetString(PyExc_ValueError,
+                            "width too big");
+            return NULL;
+        }
         width = (width*10) + (*f - '0');
         f++;
     }
@@ -2364,6 +2369,11 @@
     if (*f == '.') {
         f++;
         while (Py_ISDIGIT((unsigned)*f)) {
+            if (precision > (INT_MAX - ((int)*f - '0')) / 10) {
+                PyErr_SetString(PyExc_ValueError,
+                                "precision too big");
+                return NULL;
+            }
             precision = (precision*10) + (*f - '0');
             f++;
         }
@@ -13589,7 +13599,7 @@
                     break;
                 if (arg->prec > (INT_MAX - ((int)arg->ch - '0')) / 10) {
                     PyErr_SetString(PyExc_ValueError,
-                                    "prec too big");
+                                    "precision too big");
                     return -1;
                 }
                 arg->prec = arg->prec*10 + (arg->ch - '0');