From b45f351832b00c80bf9881e92b12c330324e3116 Mon Sep 17 00:00:00 2001 From: Neal Norwitz Date: Sat, 12 Aug 2006 01:57:47 +0000 Subject: I'm not sure why this code allocates this string for the error message. I think it would be better to always use snprintf and have the format limit the size of the name appropriately (like %.200s). Klocwork #340 --- Modules/unicodedata.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/Modules/unicodedata.c b/Modules/unicodedata.c index 7f8592f..a11a0b7 100644 --- a/Modules/unicodedata.c +++ b/Modules/unicodedata.c @@ -1078,6 +1078,7 @@ unicodedata_lookup(PyObject* self, PyObject* args) { Py_UCS4 code; Py_UNICODE str[1]; + char errbuf[256]; char* name; int namelen; @@ -1085,11 +1086,19 @@ unicodedata_lookup(PyObject* self, PyObject* args) return NULL; if (!_getcode(self, name, namelen, &code)) { + /* XXX(nnorwitz): why are we allocating for the error msg? + Why not always use snprintf? */ char fmt[] = "undefined character name '%s'"; char *buf = PyMem_MALLOC(sizeof(fmt) + namelen); - sprintf(buf, fmt, name); + if (buf) + sprintf(buf, fmt, name); + else { + buf = errbuf; + PyOS_snprintf(buf, sizeof(errbuf), fmt, name); + } PyErr_SetString(PyExc_KeyError, buf); - PyMem_FREE(buf); + if (buf != errbuf) + PyMem_FREE(buf); return NULL; } -- cgit v0.12