Issue #29044: Fix a use-after-free in string '%c' formatter.

ea1cf870 · Xiang Zhang · c67983b8 · ea1cf870
Commit ea1cf870 authored Dec 22, 2016 by Xiang Zhang
Hide whitespace changes
Inline Side-by-side

Showing with 4 additions and 3 deletions

Objects/unicodeobject.c Objects/unicodeobject.c +4 -3

No files found.
--- a/Objects/unicodeobject.c
+++ b/Objects/unicodeobject.c
@@ -14213,11 +14213,12 @@ formatchar(PyObject *v)
            if (iobj == NULL) {
                goto onError;
            }
-            v = iobj;
+            x = PyLong_AsLong(iobj);
            Py_DECREF(iobj);
        }
-        /* Integer input truncated to a character */
+        else {
-        x = PyLong_AsLong(v);
+            x = PyLong_AsLong(v);
+        }
        if (x == -1 && PyErr_Occurred())
            goto onError;