diff options
| author | Mark Dickinson <mdickinson@enthought.com> | 2012-10-28 10:18:03 (GMT) |
|---|---|---|
| committer | Mark Dickinson <mdickinson@enthought.com> | 2012-10-28 10:18:03 (GMT) |
| commit | fb90c0934c22041cad1fc4019c9853205befc967 (patch) | |
| tree | 8814d98ae8a6cc931232a07790c55c40072aaccb /Objects | |
| parent | 579d5cd643d31b732e6e7707582276565e44ece9 (diff) | |
| download | cpython-fb90c0934c22041cad1fc4019c9853205befc967.zip cpython-fb90c0934c22041cad1fc4019c9853205befc967.tar.gz cpython-fb90c0934c22041cad1fc4019c9853205befc967.tar.bz2 | |
Issue #14700: Fix buggy overflow checks for large precision and width in new-style and old-style formatting.
Diffstat (limited to 'Objects')
| -rw-r--r-- | Objects/stringlib/formatter.h | 16 | ||||
| -rw-r--r-- | Objects/stringlib/string_format.h | 15 | ||||
| -rw-r--r-- | Objects/unicodeobject.c | 4 |
3 files changed, 15 insertions, 20 deletions
diff --git a/Objects/stringlib/formatter.h b/Objects/stringlib/formatter.h index 4fdc62d..139b56c 100644 --- a/Objects/stringlib/formatter.h +++ b/Objects/stringlib/formatter.h @@ -73,7 +73,7 @@ static int get_integer(STRINGLIB_CHAR **ptr, STRINGLIB_CHAR *end, Py_ssize_t *result) { - Py_ssize_t accumulator, digitval, oldaccumulator; + Py_ssize_t accumulator, digitval; int numdigits; accumulator = numdigits = 0; for (;;(*ptr)++, numdigits++) { @@ -83,19 +83,17 @@ get_integer(STRINGLIB_CHAR **ptr, STRINGLIB_CHAR *end, if (digitval < 0) break; /* - This trick was copied from old Unicode format code. It's cute, - but would really suck on an old machine with a slow divide - implementation. Fortunately, in the normal case we do not - expect too many digits. + Detect possible overflow before it happens: + + accumulator * 10 + digitval > PY_SSIZE_T_MAX if and only if + accumulator > (PY_SSIZE_T_MAX - digitval) / 10. */ - oldaccumulator = accumulator; - accumulator *= 10; - if ((accumulator+10)/10 != oldaccumulator+1) { + if (accumulator > (PY_SSIZE_T_MAX - digitval) / 10) { PyErr_Format(PyExc_ValueError, "Too many decimal digits in format string"); return -1; } - accumulator += digitval; + accumulator = accumulator * 10 + digitval; } *result = accumulator; return numdigits; diff --git a/Objects/stringlib/string_format.h b/Objects/stringlib/string_format.h index 6c7adcb..c46bdc2 100644 --- a/Objects/stringlib/string_format.h +++ b/Objects/stringlib/string_format.h @@ -197,7 +197,6 @@ get_integer(const SubString *str) { Py_ssize_t accumulator = 0; Py_ssize_t digitval; - Py_ssize_t oldaccumulator; STRINGLIB_CHAR *p; /* empty string is an error */ @@ -209,19 +208,17 @@ get_integer(const SubString *str) if (digitval < 0) return -1; /* - This trick was copied from old Unicode format code. It's cute, - but would really suck on an old machine with a slow divide - implementation. Fortunately, in the normal case we do not - expect too many digits. + Detect possible overflow before it happens: + + accumulator * 10 + digitval > PY_SSIZE_T_MAX if and only if + accumulator > (PY_SSIZE_T_MAX - digitval) / 10. */ - oldaccumulator = accumulator; - accumulator *= 10; - if ((accumulator+10)/10 != oldaccumulator+1) { + if (accumulator > (PY_SSIZE_T_MAX - digitval) / 10) { PyErr_Format(PyExc_ValueError, "Too many decimal digits in format string"); return -1; } - accumulator += digitval; + accumulator = accumulator * 10 + digitval; } return accumulator; } diff --git a/Objects/unicodeobject.c b/Objects/unicodeobject.c index 1dd3a85..3ef9c9b 100644 --- a/Objects/unicodeobject.c +++ b/Objects/unicodeobject.c @@ -9648,7 +9648,7 @@ PyObject *PyUnicode_Format(PyObject *format, c = *fmt++; if (c < '0' || c > '9') break; - if ((width*10) / 10 != width) { + if (width > (PY_SSIZE_T_MAX - ((int)c - '0')) / 10) { PyErr_SetString(PyExc_ValueError, "width too big"); goto onError; @@ -9683,7 +9683,7 @@ PyObject *PyUnicode_Format(PyObject *format, c = *fmt++; if (c < '0' || c > '9') break; - if ((prec*10) / 10 != prec) { + if (prec > (INT_MAX - ((int)c - '0')) / 10) { PyErr_SetString(PyExc_ValueError, "prec too big"); goto onError; |