Issue #23055: Fixed off-by-one error in PyUnicode_FromFormatV.

426d548e · Serhiy Storchaka · e0251d34 · 426d548e
Commit 426d548e authored Jan 30, 2015 by Serhiy Storchaka
Hide whitespace changes
Inline Side-by-side

Showing with 2 additions and 1 deletion

Objects/unicodeobject.c Objects/unicodeobject.c +2 -1

No files found.
--- a/Objects/unicodeobject.c
+++ b/Objects/unicodeobject.c
@@ -893,7 +893,8 @@ PyUnicode_FromFormatV(const char *format, va_list vargs)
    }
  expand:
    if (abuffersize > 20) {
-        abuffer = PyObject_Malloc(abuffersize);
+        /* add 1 for sprintf's trailing null byte */
+        abuffer = PyObject_Malloc(abuffersize + 1);
        if (!abuffer) {
            PyErr_NoMemory();
            goto fail;