[3.6] bpo-29714: Fix a regression that bytes format may fail when containing zero bytes inside. (GH-504)

3 files changed, 15 insertions, 2 deletions

diff --git a/Lib/test/test_bytes.py b/Lib/test/test_bytes.py
index a103a7d..cd82fa6 100644
--- a/Lib/test/test_bytes.py
+++ b/Lib/test/test_bytes.py
@@ -507,6 +507,11 @@ class BaseBytesTest:
         a = b % (b'seventy-nine', 79)
         self.assertEqual(a, b'seventy-nine / 100 = 79%')
         self.assertIs(type(a), self.type2test)
+        # issue 29714
+        b = self.type2test(b'hello,\x00%b!')
+        b = b % b'world'
+        self.assertEqual(b, b'hello,\x00world!')
+        self.assertIs(type(b), self.type2test)
 
     def test_imod(self):
         b = self.type2test(b'hello, %b!')
@@ -519,6 +524,11 @@ class BaseBytesTest:
         b %= (b'seventy-nine', 79)
         self.assertEqual(b, b'seventy-nine / 100 = 79%')
         self.assertIs(type(b), self.type2test)
+        # issue 29714
+        b = self.type2test(b'hello,\x00%b!')
+        b %= b'world'
+        self.assertEqual(b, b'hello,\x00world!')
+        self.assertIs(type(b), self.type2test)
 
     def test_rmod(self):
         with self.assertRaises(TypeError):
diff --git a/Misc/NEWS b/Misc/NEWS
index a122298..1fb7836 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -10,6 +10,9 @@ What's New in Python 3.6.1 final?
 Core and Builtins
 -----------------
 
+- bpo-29714: Fix a regression that bytes format may fail when containing zero
+  bytes inside.
+
 Library
 -------
 
diff --git a/Objects/bytesobject.c b/Objects/bytesobject.c
index 5d48440..801711f 100644
--- a/Objects/bytesobject.c
+++ b/Objects/bytesobject.c
@@ -619,11 +619,11 @@ _PyBytes_FormatEx(const char *format, Py_ssize_t format_len,
             Py_ssize_t len;
             char *pos;
 
-            pos = strchr(fmt + 1, '%');
+            pos = (char *)memchr(fmt + 1, '%', fmtcnt);
             if (pos != NULL)
                 len = pos - fmt;
             else
-                len = format_len - (fmt - format);
+                len = fmtcnt + 1;
             assert(len != 0);
 
             memcpy(res, fmt, len);