From 373602fa3f3e54ca4f7e7a87948b6df86a17a3e6 Mon Sep 17 00:00:00 2001 From: Steve Dower Date: Sat, 5 Sep 2015 12:16:06 -0700 Subject: Issue #24917: time_strftime() Buffer Over-read. Patch by John Leitch. --- Lib/test/test_time.py | 6 ++++++ Misc/NEWS | 2 ++ Modules/timemodule.c | 12 ++++++++++++ 3 files changed, 20 insertions(+) diff --git a/Lib/test/test_time.py b/Lib/test/test_time.py index 6334e02..3f571a0 100644 --- a/Lib/test/test_time.py +++ b/Lib/test/test_time.py @@ -174,6 +174,12 @@ class TimeTestCase(unittest.TestCase): def test_strftime_bounding_check(self): self._bounds_checking(lambda tup: time.strftime('', tup)) + def test_strftime_format_check(self): + for x in [ '', 'A', '%A', '%AA' ]: + for y in range(0x0, 0x10): + for z in [ '%', 'A%', 'AA%', '%A%', 'A%A%', '%#' ]: + self.assertRaises(ValueError, time.strftime, x * y + z) + def test_default_values_for_zero(self): # Make sure that using all zeros uses the proper default # values. No test for daylight savings since strftime() does diff --git a/Misc/NEWS b/Misc/NEWS index 2b1f278..b8698eb 100644 --- a/Misc/NEWS +++ b/Misc/NEWS @@ -10,6 +10,8 @@ Release date: 2015-09-06 Core and Builtins ----------------- +- Issue #24917: time_strftime() Buffer Over-read. Patch by John Leitch. + - Issue #24912: Prevent __class__ assignment to immutable built-in objects. - Issue #24975: Fix AST compilation for PEP 448 syntax. diff --git a/Modules/timemodule.c b/Modules/timemodule.c index 197d2c0..55e26fa 100644 --- a/Modules/timemodule.c +++ b/Modules/timemodule.c @@ -623,6 +623,12 @@ time_strftime(PyObject *self, PyObject *args) Py_DECREF(format); return NULL; } + else if (outbuf[1] == '\0') + { + PyErr_SetString(PyExc_ValueError, "Incomplete format string"); + Py_DECREF(format); + return NULL; + } } #elif (defined(_AIX) || defined(sun)) && defined(HAVE_WCSFTIME) for(outbuf = wcschr(fmt, '%'); @@ -636,6 +642,12 @@ time_strftime(PyObject *self, PyObject *args) "format %y requires year >= 1900 on AIX"); return NULL; } + else if (outbuf[1] == '\0') + { + PyErr_SetString(PyExc_ValueError, "Incomplete format string"); + Py_DECREF(format); + return NULL; + } } #endif -- cgit v0.12 From 699534210c935de3d5041c801bd97270fd31a522 Mon Sep 17 00:00:00 2001 From: Steve Dower Date: Sat, 5 Sep 2015 12:23:00 -0700 Subject: Issue #24917: Moves NEWS entry under Library. --- Misc/NEWS | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Misc/NEWS b/Misc/NEWS index b8698eb..11d7de4 100644 --- a/Misc/NEWS +++ b/Misc/NEWS @@ -10,8 +10,6 @@ Release date: 2015-09-06 Core and Builtins ----------------- -- Issue #24917: time_strftime() Buffer Over-read. Patch by John Leitch. - - Issue #24912: Prevent __class__ assignment to immutable built-in objects. - Issue #24975: Fix AST compilation for PEP 448 syntax. @@ -19,6 +17,8 @@ Core and Builtins Library ------- +- Issue #24917: time_strftime() Buffer Over-read. Patch by John Leitch. + - Issue #24635: Fixed a bug in typing.py where isinstance([], typing.Iterable) would return True once, then False on subsequent calls. -- cgit v0.12