From: Xiang Zhang <angwerzx@126.com>
Date: Thu, 22 Dec 2016 07:30:47 +0000 (+0800)
Subject: Issue #29044: Fix a use-after-free in string '%c' formatter.
X-Git-Tag: v3.5.3rc1~39
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=ea1cf870305ad46fae53d338474b6b13f7fe14d4;p=thirdparty%2FPython%2Fcpython.git

Issue #29044: Fix a use-after-free in string '%c' formatter.
---

diff --git a/Objects/unicodeobject.c b/Objects/unicodeobject.c
index ab261cc953f3..57878308b7b2 100644
--- a/Objects/unicodeobject.c
+++ b/Objects/unicodeobject.c
@@ -14213,11 +14213,12 @@ formatchar(PyObject *v)
             if (iobj == NULL) {
                 goto onError;
             }
-            v = iobj;
+            x = PyLong_AsLong(iobj);
             Py_DECREF(iobj);
         }
-        /* Integer input truncated to a character */
-        x = PyLong_AsLong(v);
+        else {
+            x = PyLong_AsLong(v);
+        }
         if (x == -1 && PyErr_Occurred())
             goto onError;