diff options
| author | Xiang Zhang <angwerzx@126.com> | 2016-12-22 07:30:47 (GMT) |
|---|---|---|
| committer | Xiang Zhang <angwerzx@126.com> | 2016-12-22 07:30:47 (GMT) |
| commit | ea1cf870305ad46fae53d338474b6b13f7fe14d4 (patch) | |
| tree | 592789379c32fd6f30e3afb1f526abb102cbf5c3 /Objects/unicodeobject.c | |
| parent | c67983b829ce00ad71ac016c200f5e16bfc493f6 (diff) | |
| download | cpython-ea1cf870305ad46fae53d338474b6b13f7fe14d4.zip cpython-ea1cf870305ad46fae53d338474b6b13f7fe14d4.tar.gz cpython-ea1cf870305ad46fae53d338474b6b13f7fe14d4.tar.bz2 | |
Issue #29044: Fix a use-after-free in string '%c' formatter.
Diffstat (limited to 'Objects/unicodeobject.c')
| -rw-r--r-- | Objects/unicodeobject.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/Objects/unicodeobject.c b/Objects/unicodeobject.c index ab261cc..5787830 100644 --- a/Objects/unicodeobject.c +++ b/Objects/unicodeobject.c @@ -14213,11 +14213,12 @@ formatchar(PyObject *v) if (iobj == NULL) { goto onError; } - v = iobj; + x = PyLong_AsLong(iobj); Py_DECREF(iobj); } - /* Integer input truncated to a character */ - x = PyLong_AsLong(v); + else { + x = PyLong_AsLong(v); + } if (x == -1 && PyErr_Occurred()) goto onError; |