[Backport r51226 | neal.norwitz]

I'm not sure why this code allocates this string for the error message.
I think it would be better to always use snprintf and have the format
limit the size of the name appropriately (like %.200s).

Klocwork #340

diff --git a/Modules/unicodedata.c b/Modules/unicodedata.c
index 2f97df1978f6593dadb35ad26ab5fd8a3df4b876..52086f6aee739eff0234a19ce4dbdff353ff552f 100644 (file)
--- a/Modules/unicodedata.c
+++ b/Modules/unicodedata.c
@@ -869,6 +869,7 @@ unicodedata_lookup(PyObject* self, PyObject* args)
 {
     Py_UCS4 code;
     Py_UNICODE str[1];
+    char errbuf[256];
 
     char* name;
     int namelen;
@@ -876,11 +877,19 @@ unicodedata_lookup(PyObject* self, PyObject* args)
         return NULL;
 
     if (!_getcode(name, namelen, &code)) {
+       /* XXX(nnorwitz): why are we allocating for the error msg?
+               Why not always use snprintf? */
         char fmt[] = "undefined character name '%s'";
         char *buf = PyMem_MALLOC(sizeof(fmt) + namelen);
-        sprintf(buf, fmt, name);
+        if (buf)
+            sprintf(buf, fmt, name);
+        else {
+            buf = errbuf;
+            PyOS_snprintf(buf, sizeof(errbuf), fmt, name);
+        }
         PyErr_SetString(PyExc_KeyError, buf);
-        PyMem_FREE(buf);
+        if (buf != errbuf)
+               PyMem_FREE(buf);
         return NULL;
     }