diff options
| -rw-r--r-- | Lib/test/test_bytes.py | 6 | ||||
| -rw-r--r-- | Misc/NEWS | 3 | ||||
| -rw-r--r-- | Objects/bytesobject.c | 19 |
3 files changed, 25 insertions, 3 deletions
diff --git a/Lib/test/test_bytes.py b/Lib/test/test_bytes.py index 3520e83..3c09141 100644 --- a/Lib/test/test_bytes.py +++ b/Lib/test/test_bytes.py @@ -729,6 +729,12 @@ class BytesTest(BaseBytesTest, unittest.TestCase): self.assertEqual(PyBytes_FromFormat(b's:%s', c_char_p(b'cstr')), b's:cstr') + # Issue #19969 + self.assertRaises(OverflowError, + PyBytes_FromFormat, b'%c', c_int(-1)) + self.assertRaises(OverflowError, + PyBytes_FromFormat, b'%c', c_int(256)) + class ByteArrayTest(BaseBytesTest, unittest.TestCase): type2test = bytearray @@ -10,6 +10,9 @@ What's New in Python 3.3.4 release candidate 1? Core and Builtins ----------------- +- Issue #19969: PyBytes_FromFormatV() now raises an OverflowError if "%c" + argument is not in range [0; 255]. + - Issue #14432: Generator now clears the borrowed reference to the thread state. Fix a crash when a generator is created in a C thread that is destroyed while the generator is still used. The issue was that a generator diff --git a/Objects/bytesobject.c b/Objects/bytesobject.c index 47898fe..9dcb74e 100644 --- a/Objects/bytesobject.c +++ b/Objects/bytesobject.c @@ -186,8 +186,17 @@ PyBytes_FromFormatV(const char *format, va_list vargs) switch (*f) { case 'c': - (void)va_arg(count, int); - /* fall through... */ + { + int c = va_arg(count, int); + if (c < 0 || c > 255) { + PyErr_SetString(PyExc_OverflowError, + "PyBytes_FromFormatV(): %c format " + "expects an integer in range [0; 255]"); + return NULL; + } + n++; + break; + } case '%': n++; break; @@ -267,8 +276,12 @@ PyBytes_FromFormatV(const char *format, va_list vargs) switch (*f) { case 'c': - *s++ = va_arg(vargs, int); + { + int c = va_arg(vargs, int); + /* c has been checked for overflow in the first step */ + *s++ = (unsigned char)c; break; + } case 'd': if (longflag) sprintf(s, "%ld", va_arg(vargs, long)); |