Fix segfault when doing string formatting on subclasses of long if

__oct__, __hex__ don't return a string.

Klocwork 308

diff --git a/Lib/test/test_format.py b/Lib/test/test_format.py
index 29594475c25339ec3c181a956d93766f01d40ddd..a9b31707a24917c8e357fb136998a9588a413630 100644 (file)
--- a/Lib/test/test_format.py
+++ b/Lib/test/test_format.py
@@ -230,6 +230,14 @@ test_exc(u'no format', '1', TypeError,
 test_exc(u'no format', u'1', TypeError,
          "not all arguments converted during string formatting")
 
+class Foobar(long):
+    def __oct__(self):
+        # Returning a non-string should not blow up.
+        return self + 1
+
+test_exc('%o', Foobar(), TypeError,
+         "expected string or Unicode object, long found")
+
 if sys.maxint == 2**31-1:
     # crashes 2.2.1 and earlier:
     try:

diff --git a/Misc/NEWS b/Misc/NEWS
index f81389d6bc7ac5255768fca0a7a2756fca452b93..5894c16be118e6e9a53c117d61268457e88c25a2 100644 (file)
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -12,6 +12,8 @@ What's New in Python 2.5 release candidate 1?
 Core and builtins
 -----------------
 
+- Fix segfault when doing string formatting on subclasses of long.
+
 - Fix bug related to __len__ functions using values > 2**32 on 64-bit machines
   with new-style classes.
   

diff --git a/Objects/stringobject.c b/Objects/stringobject.c
index bbbeaa6c0a4c7ac6257cd0ddddea3f2f003c6535..2189a8209f60de73441e4fe7d4ecd6d1fadf2ca7 100644 (file)
--- a/Objects/stringobject.c
+++ b/Objects/stringobject.c
@@ -4225,12 +4225,15 @@ _PyString_FormatLong(PyObject *val, int flags, int prec, int type,
        if (!result)
                return NULL;
 
+       buf = PyString_AsString(result);
+       if (!buf)
+               return NULL;
+
        /* To modify the string in-place, there can only be one reference. */
        if (result->ob_refcnt != 1) {
                PyErr_BadInternalCall();
                return NULL;
        }
-       buf = PyString_AsString(result);
        llen = PyString_Size(result);
        if (llen > PY_SSIZE_T_MAX) {
                PyErr_SetString(PyExc_ValueError, "string too large in _PyString_FormatLong");