Commit 555755ec authored by Serhiy Storchaka's avatar Serhiy Storchaka Committed by GitHub

[2.7] bpo-35552: Fix reading past the end in PyString_FromFormat(). (GH-11276) (GH-11534)

Format character "%s" in PyString_FromFormat() no longer read memory
past the limit if precision is specified.
(cherry picked from commit d586ccb0)
parent 08a81df0
Format character ``%s`` in :c:func:`PyString_FromFormat` no longer read
memory past the limit if *precision* is specified.
...@@ -360,9 +360,15 @@ PyString_FromFormatV(const char *format, va_list vargs) ...@@ -360,9 +360,15 @@ PyString_FromFormatV(const char *format, va_list vargs)
break; break;
case 's': case 's':
p = va_arg(vargs, char*); p = va_arg(vargs, char*);
i = strlen(p); if (n <= 0) {
if (n > 0 && i > n) i = strlen(p);
i = n; }
else {
i = 0;
while (i < n && p[i]) {
i++;
}
}
Py_MEMCPY(s, p, i); Py_MEMCPY(s, p, i);
s += i; s += i;
break; break;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment