I'm not sure why this code allocates this string for the error message.

I think it would be better to always use snprintf and have the format
limit the size of the name appropriately (like %.200s).

Klocwork #340

1 files changed, 11 insertions, 2 deletions

diff --git a/Modules/unicodedata.c b/Modules/unicodedata.c
index 7f8592f..a11a0b7 100644
--- a/Modules/unicodedata.c
+++ b/Modules/unicodedata.c
@@ -1078,6 +1078,7 @@ unicodedata_lookup(PyObject* self, PyObject* args)
 {
     Py_UCS4 code;
     Py_UNICODE str[1];
+    char errbuf[256];
 
     char* name;
     int namelen;
@@ -1085,11 +1086,19 @@ unicodedata_lookup(PyObject* self, PyObject* args)
         return NULL;
 
     if (!_getcode(self, name, namelen, &code)) {
+	/* XXX(nnorwitz): why are we allocating for the error msg?
+		Why not always use snprintf? */
         char fmt[] = "undefined character name '%s'";
         char *buf = PyMem_MALLOC(sizeof(fmt) + namelen);
-        sprintf(buf, fmt, name);
+        if (buf)
+            sprintf(buf, fmt, name);
+        else {
+            buf = errbuf;
+            PyOS_snprintf(buf, sizeof(errbuf), fmt, name);
+        }
         PyErr_SetString(PyExc_KeyError, buf);
-        PyMem_FREE(buf);
+        if (buf != errbuf)
+        	PyMem_FREE(buf);
         return NULL;
     }