diff options
| author | Mark Dickinson <dickinsm@gmail.com> | 2009-03-29 16:18:33 (GMT) |
|---|---|---|
| committer | Mark Dickinson <dickinsm@gmail.com> | 2009-03-29 16:18:33 (GMT) |
| commit | 87886195405dd28f259f839d2c4410b0309077b9 (patch) | |
| tree | 1950064a1b81ed749f7ea18578469d6b970d4bc0 /Objects/stringobject.c | |
| parent | a30f349ecf57d7280bf179d6446f8fe5a3dede4f (diff) | |
| download | cpython-87886195405dd28f259f839d2c4410b0309077b9.zip cpython-87886195405dd28f259f839d2c4410b0309077b9.tar.gz cpython-87886195405dd28f259f839d2c4410b0309077b9.tar.bz2 | |
Merged revisions 70682 via svnmerge from
svn+ssh://pythondev@svn.python.org/python/trunk
........
r70682 | mark.dickinson | 2009-03-29 17:17:16 +0100 (Sun, 29 Mar 2009) | 3 lines
Issue #532631: Add paranoid check to avoid potential buffer overflow
on systems with sizeof(int) > 4.
........
Diffstat (limited to 'Objects/stringobject.c')
| -rw-r--r-- | Objects/stringobject.c | 11 |
1 files changed, 10 insertions, 1 deletions
diff --git a/Objects/stringobject.c b/Objects/stringobject.c index 84e107b..8916552 100644 --- a/Objects/stringobject.c +++ b/Objects/stringobject.c @@ -4336,6 +4336,15 @@ formatfloat(char *buf, size_t buflen, int flags, } if (prec < 0) prec = 6; + /* make sure that the decimal representation of precision really does + need at most 10 digits: platforms with sizeof(int) == 8 exist! */ + if (prec > 0x7fffffffL) { + PyErr_SetString(PyExc_OverflowError, + "outrageously large precision " + "for formatted float"); + return -1; + } + if (type == 'f' && fabs(x) >= 1e50) type = 'g'; /* Worst case length calc to ensure no buffer overrun: @@ -4364,7 +4373,7 @@ formatfloat(char *buf, size_t buflen, int flags, PyOS_snprintf(fmt, sizeof(fmt), "%%%s.%d%c", (flags&F_ALT) ? "#" : "", prec, type); - PyOS_ascii_formatd(buf, buflen, fmt, x); + PyOS_ascii_formatd(buf, buflen, fmt, x); return (int)strlen(buf); } |