Issue #26198: ValueError is now raised instead of TypeError on buffer

overflow in parsing "es#" and "et#" format units.  SystemError is now raised
instead of TypeError on programmical error in parsing format string.

4 files changed, 20 insertions, 8 deletions

diff --git a/Lib/test/test_capi.py b/Lib/test/test_capi.py
index 96666d1..1a743fd 100644
--- a/Lib/test/test_capi.py
+++ b/Lib/test/test_capi.py
@@ -488,10 +488,10 @@ class SkipitemTest(unittest.TestCase):
                 _testcapi.parse_tuple_and_keywords(tuple_1, dict_b,
                     format.encode("ascii"), keywords)
                 when_not_skipped = False
-            except TypeError as e:
+            except SystemError as e:
                 s = "argument 1 (impossible<bad format char>)"
                 when_not_skipped = (str(e) == s)
-            except RuntimeError as e:
+            except (TypeError, RuntimeError):
                 when_not_skipped = False
 
             # test the format unit when skipped
diff --git a/Lib/test/test_getargs2.py b/Lib/test/test_getargs2.py
index 6491135..be777af 100644
--- a/Lib/test/test_getargs2.py
+++ b/Lib/test/test_getargs2.py
@@ -636,10 +636,10 @@ class String_TestCase(unittest.TestCase):
         self.assertEqual(getargs_es_hash('abc\xe9', 'latin1', buf), b'abc\xe9')
         self.assertEqual(buf, bytearray(b'abc\xe9\x00'))
         buf = bytearray(b'x'*4)
-        self.assertRaises(TypeError, getargs_es_hash, 'abc\xe9', 'latin1', buf)
+        self.assertRaises(ValueError, getargs_es_hash, 'abc\xe9', 'latin1', buf)
         self.assertEqual(buf, bytearray(b'x'*4))
         buf = bytearray()
-        self.assertRaises(TypeError, getargs_es_hash, 'abc\xe9', 'latin1', buf)
+        self.assertRaises(ValueError, getargs_es_hash, 'abc\xe9', 'latin1', buf)
 
     def test_et_hash(self):
         from _testcapi import getargs_et_hash
@@ -662,10 +662,10 @@ class String_TestCase(unittest.TestCase):
         self.assertEqual(getargs_et_hash('abc\xe9', 'latin1', buf), b'abc\xe9')
         self.assertEqual(buf, bytearray(b'abc\xe9\x00'))
         buf = bytearray(b'x'*4)
-        self.assertRaises(TypeError, getargs_et_hash, 'abc\xe9', 'latin1', buf)
+        self.assertRaises(ValueError, getargs_et_hash, 'abc\xe9', 'latin1', buf)
         self.assertEqual(buf, bytearray(b'x'*4))
         buf = bytearray()
-        self.assertRaises(TypeError, getargs_et_hash, 'abc\xe9', 'latin1', buf)
+        self.assertRaises(ValueError, getargs_et_hash, 'abc\xe9', 'latin1', buf)
 
     def test_u(self):
         from _testcapi import getargs_u
diff --git a/Misc/NEWS b/Misc/NEWS
index a7c3f58..7a198d6 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -713,6 +713,13 @@ Tools/Demos
 - Issue #25154: The pyvenv script has been deprecated in favour of
   `python3 -m venv`.
 
+C API
+-----
+
+- Issue #26198: ValueError is now raised instead of TypeError on buffer
+  overflow in parsing "es#" and "et#" format units.  SystemError is now raised
+  instead of TypeError on programmical error in parsing format string.
+
 
 What's New in Python 3.5.1 final?
 =================================
diff --git a/Python/getargs.c b/Python/getargs.c
index 60b7677..be6e375 100644
--- a/Python/getargs.c
+++ b/Python/getargs.c
@@ -394,7 +394,12 @@ seterror(Py_ssize_t iarg, const char *msg, int *levels, const char *fname,
         PyOS_snprintf(p, sizeof(buf) - (p - buf), " %.256s", msg);
         message = buf;
     }
-    PyErr_SetString(PyExc_TypeError, message);
+    if (msg[0] == '(') {
+        PyErr_SetString(PyExc_SystemError, message);
+    }
+    else {
+        PyErr_SetString(PyExc_TypeError, message);
+    }
 }
 
 
@@ -1129,7 +1134,7 @@ convertsimple(PyObject *arg, const char **p_format, va_list *p_va, int flags,
             } else {
                 if (size + 1 > BUFFER_LEN) {
                     Py_DECREF(s);
-                    PyErr_Format(PyExc_TypeError,
+                    PyErr_Format(PyExc_ValueError,
                                  "encoded string too long "
                                  "(%zd, maximum length %zd)",
                                  (Py_ssize_t)size, (Py_ssize_t)(BUFFER_LEN-1));