correctly overflow when indexes are too large

3 files changed, 10 insertions, 0 deletions

diff --git a/Lib/test/test_unicode.py b/Lib/test/test_unicode.py
index 4550be8..b3b24de 100644
--- a/Lib/test/test_unicode.py
+++ b/Lib/test/test_unicode.py
@@ -1282,6 +1282,9 @@ class UnicodeTest(
         self.assertRaises(IndexError, u"{:}".format)
         self.assertRaises(IndexError, u"{:s}".format)
         self.assertRaises(IndexError, u"{}".format)
+        big = "23098475029384702983476098230754973209482573"
+        self.assertRaises(ValueError, ("{" + big + "}").format)
+        self.assertRaises(ValueError, ("{[" + big + "]}").format, [0])
 
         # issue 6089
         self.assertRaises(ValueError, u"{0[0]x}".format, [None])
diff --git a/Misc/NEWS b/Misc/NEWS
index dfdda16..4424228 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -12,6 +12,9 @@ What's New in Python release candidate 2?
 Core and Builtins
 -----------------
 
+- In the unicode/str.format(), raise a ValueError when either indexes to
+  arguments are too large.
+
 Library
 -------
 
diff --git a/Objects/stringlib/string_format.h b/Objects/stringlib/string_format.h
index 0aafb14..e7bf724 100644
--- a/Objects/stringlib/string_format.h
+++ b/Objects/stringlib/string_format.h
@@ -373,6 +373,8 @@ FieldNameIterator_next(FieldNameIterator *self, int *is_attribute,
         if (_FieldNameIterator_item(self, name) == 0)
             return 0;
         *name_idx = get_integer(name);
+        if (*name_idx == -1 && PyErr_Occurred())
+            return 0;
         break;
     default:
         /* Invalid character follows ']' */
@@ -429,6 +431,8 @@ field_name_split(STRINGLIB_CHAR *ptr, Py_ssize_t len, SubString *first,
 
     /* see if "first" is an integer, in which case it's used as an index */
     *first_idx = get_integer(first);
+    if (*first_idx == -1 && PyErr_Occurred())
+        return 0;
 
     field_name_is_empty = first->ptr >= first->end;