From: Victor Stinner <victor.stinner@gmail.com>
Date: Fri, 13 Dec 2013 11:14:44 +0000 (+0100)
Subject: Issue #19969: PyBytes_FromFormatV() now raises an OverflowError if "%c"
X-Git-Tag: v3.4.0b2~235^2
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=c9362cf86ae302e89207dff7206b1c6bba413e33;p=thirdparty%2FPython%2Fcpython.git

Issue #19969: PyBytes_FromFormatV() now raises an OverflowError if "%c"
argument is not in range [0; 255].
---

diff --git a/Lib/test/test_bytes.py b/Lib/test/test_bytes.py
index 3520e837a172..3c0914118491 100644
--- a/Lib/test/test_bytes.py
+++ b/Lib/test/test_bytes.py
@@ -729,6 +729,12 @@ class BytesTest(BaseBytesTest, unittest.TestCase):
         self.assertEqual(PyBytes_FromFormat(b's:%s', c_char_p(b'cstr')),
                          b's:cstr')
 
+        # Issue #19969
+        self.assertRaises(OverflowError,
+                          PyBytes_FromFormat, b'%c', c_int(-1))
+        self.assertRaises(OverflowError,
+                          PyBytes_FromFormat, b'%c', c_int(256))
+
 
 class ByteArrayTest(BaseBytesTest, unittest.TestCase):
     type2test = bytearray
diff --git a/Misc/NEWS b/Misc/NEWS
index cd14311aab9c..a66834944dcf 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -10,6 +10,9 @@ What's New in Python 3.3.4 release candidate 1?
 Core and Builtins
 -----------------
 
+- Issue #19969: PyBytes_FromFormatV() now raises an OverflowError if "%c"
+  argument is not in range [0; 255].
+
 - Issue #14432: Generator now clears the borrowed reference to the thread
   state. Fix a crash when a generator is created in a C thread that is
   destroyed while the generator is still used. The issue was that a generator
diff --git a/Objects/bytesobject.c b/Objects/bytesobject.c
index 47898fe975cf..9dcb74e8fdb2 100644
--- a/Objects/bytesobject.c
+++ b/Objects/bytesobject.c
@@ -186,8 +186,17 @@ PyBytes_FromFormatV(const char *format, va_list vargs)
 
             switch (*f) {
             case 'c':
-                (void)va_arg(count, int);
-                /* fall through... */
+            {
+                int c = va_arg(count, int);
+                if (c < 0 || c > 255) {
+                    PyErr_SetString(PyExc_OverflowError,
+                                    "PyBytes_FromFormatV(): %c format "
+                                    "expects an integer in range [0; 255]");
+                    return NULL;
+                }
+                n++;
+                break;
+            }
             case '%':
                 n++;
                 break;
@@ -267,8 +276,12 @@ PyBytes_FromFormatV(const char *format, va_list vargs)
 
             switch (*f) {
             case 'c':
-                *s++ = va_arg(vargs, int);
+            {
+                int c = va_arg(vargs, int);
+                /* c has been checked for overflow in the first step */
+                *s++ = (unsigned char)c;
                 break;
+            }
             case 'd':
                 if (longflag)
                     sprintf(s, "%ld", va_arg(vargs, long));