From: Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com>
Date: Sat, 12 Jan 2019 08:52:55 +0000 (-0800)
Subject: bpo-35552: Fix reading past the end in PyUnicode_FromFormat() and PyBytes_FromFormat... 
X-Git-Tag: v3.7.3rc1~153
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=cbc7c2c791185ad44b4b3ede72309df5f252f4cb;p=thirdparty%2FPython%2Fcpython.git

bpo-35552: Fix reading past the end in PyUnicode_FromFormat() and PyBytes_FromFormat(). (GH-11276)


Format characters "%s" and "%V" in PyUnicode_FromFormat() and "%s" in PyBytes_FromFormat()
no longer read memory past the limit if precision is specified.
(cherry picked from commit d586ccb04f79863c819b212ec5b9d873964078e4)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
---

diff --git a/Misc/NEWS.d/next/Core and Builtins/2018-12-21-13-29-30.bpo-35552.1DzQQc.rst b/Misc/NEWS.d/next/Core and Builtins/2018-12-21-13-29-30.bpo-35552.1DzQQc.rst
new file mode 100644
index 000000000000..dbc00bcd75e9
--- /dev/null
+++ b/Misc/NEWS.d/next/Core and Builtins/2018-12-21-13-29-30.bpo-35552.1DzQQc.rst	
@@ -0,0 +1,3 @@
+Format characters ``%s`` and ``%V`` in :c:func:`PyUnicode_FromFormat` and
+``%s`` in :c:func:`PyBytes_FromFormat` no longer read memory past the
+limit if *precision* is specified.
diff --git a/Objects/bytesobject.c b/Objects/bytesobject.c
index 5f9e1eccf2e4..172c7f38b9e2 100644
--- a/Objects/bytesobject.c
+++ b/Objects/bytesobject.c
@@ -311,9 +311,15 @@ PyBytes_FromFormatV(const char *format, va_list vargs)
             Py_ssize_t i;
 
             p = va_arg(vargs, const char*);
-            i = strlen(p);
-            if (prec > 0 && i > prec)
-                i = prec;
+            if (prec <= 0) {
+                i = strlen(p);
+            }
+            else {
+                i = 0;
+                while (i < prec && p[i]) {
+                    i++;
+                }
+            }
             s = _PyBytesWriter_WriteBytes(&writer, s, p, i);
             if (s == NULL)
                 goto error;
diff --git a/Objects/unicodeobject.c b/Objects/unicodeobject.c
index 35c8a24b7c0c..b67ffac4e9fb 100644
--- a/Objects/unicodeobject.c
+++ b/Objects/unicodeobject.c
@@ -2579,9 +2579,15 @@ unicode_fromformat_write_cstr(_PyUnicodeWriter *writer, const char *str,
     PyObject *unicode;
     int res;
 
-    length = strlen(str);
-    if (precision != -1)
-        length = Py_MIN(length, precision);
+    if (precision == -1) {
+        length = strlen(str);
+    }
+    else {
+        length = 0;
+        while (length < precision && str[length]) {
+            length++;
+        }
+    }
     unicode = PyUnicode_DecodeUTF8Stateful(str, length, "replace", NULL);
     if (unicode == NULL)
         return -1;