diff Objects/unicodeobject.c @ 81590:d544873d62e9 2.7

Issue #15989: Fix several occurrences of integer overflow when result of PyInt_AsLong() or PyLong_AsLong() narrowed to int without checks. This is a backport of changesets 13e2e44db99d and 525407d89277.
author Serhiy Storchaka <storchaka@gmail.com>
date Sat, 19 Jan 2013 12:55:39 +0200
parents 33a8ef498b1e
children f4d30d1a529e
line wrap: on
line diff
--- a/Objects/unicodeobject.c	Fri Jan 18 23:23:11 2013 -0800
+++ b/Objects/unicodeobject.c	Sat Jan 19 12:55:39 2013 +0200
@@ -8411,7 +8411,9 @@
                                     "* wants int");
                     goto onError;
                 }
-                width = PyInt_AsLong(v);
+                width = PyInt_AsSsize_t(v);
+                if (width == -1 && PyErr_Occurred())
+                    goto onError;
                 if (width < 0) {
                     flags |= F_LJUST;
                     width = -width;
@@ -8446,7 +8448,9 @@
                                         "* wants int");
                         goto onError;
                     }
-                    prec = PyInt_AsLong(v);
+                    prec = _PyInt_AsInt(v);
+                    if (prec == -1 && PyErr_Occurred())
+                        goto onError;
                     if (prec < 0)
                         prec = 0;
                     if (--fmtcnt >= 0)