Fix segfault discovered by Ron Adam. Not checking for terminating right bracket...

diff --git a/Lib/test/test_unicode.py b/Lib/test/test_unicode.py
index 6773f2ab09e74acdd06c837bc3e3392047712be4..52b7b4fff861ef0118287fe9e1bbb0f52ba0745f 100644 (file)
--- a/Lib/test/test_unicode.py
+++ b/Lib/test/test_unicode.py
@@ -458,6 +458,7 @@ class UnicodeTest(
         # weird field names
         self.assertEqual("{0[foo-bar]}".format({'foo-bar':'baz'}), 'baz')
         self.assertEqual("{0[foo bar]}".format({'foo bar':'baz'}), 'baz')
+        self.assertEqual("{0[ ]}".format({' ':3}), '3')
 
         self.assertEqual('{foo._x}'.format(foo=C(20)), '20')
         self.assertEqual('{1}{0}'.format(D(10), D(20)), '2010')
@@ -551,6 +552,7 @@ class UnicodeTest(
         self.assertRaises(ValueError, "{0".format)
         self.assertRaises(ValueError, "{0.}".format)
         self.assertRaises(ValueError, "{0[}".format)
+        self.assertRaises(ValueError, "{0[}".format, [])
         self.assertRaises(ValueError, "{0]}".format)
         self.assertRaises(ValueError, "{0.[]}".format)
         self.assertRaises(ValueError, "{0..foo}".format, 0)

diff --git a/Objects/stringlib/string_format.h b/Objects/stringlib/string_format.h
index dbd01d3e7eec624cd7f0343e6f2a4d4beaa82840..de700f618bd4326804ed2a8b8d9112d86e700dc4 100644 (file)
--- a/Objects/stringlib/string_format.h
+++ b/Objects/stringlib/string_format.h
@@ -273,6 +273,7 @@ _FieldNameIterator_attr(FieldNameIterator *self, SubString *name)
 static int
 _FieldNameIterator_item(FieldNameIterator *self, SubString *name)
 {
+    int bracket_seen = 0;
     STRINGLIB_CHAR c;
 
     name->ptr = self->ptr;
@@ -281,12 +282,19 @@ _FieldNameIterator_item(FieldNameIterator *self, SubString *name)
     while (self->ptr < self->str.end) {
         switch (c = *self->ptr++) {
         case ']':
+            bracket_seen = 1;
             break;
         default:
             continue;
         }
         break;
     }
+    /* make sure we ended with a ']' */
+    if (!bracket_seen) {
+        PyErr_SetString(PyExc_ValueError, "Missing ']' in format string");
+        return 0;
+    }
+
     /* end of string is okay */
     /* don't include the ']' */
     name->end = self->ptr-1;
@@ -305,16 +313,14 @@ FieldNameIterator_next(FieldNameIterator *self, int *is_attribute,
     switch (*self->ptr++) {
     case '.':
         *is_attribute = 1;
-        if (_FieldNameIterator_attr(self, name) == 0) {
+        if (_FieldNameIterator_attr(self, name) == 0)
             return 0;
-        }
         *name_idx = -1;
         break;
     case '[':
         *is_attribute = 0;
-        if (_FieldNameIterator_item(self, name) == 0) {
+        if (_FieldNameIterator_item(self, name) == 0)
             return 0;
-        }
         *name_idx = get_integer(name);
         break;
     default: