Skip to content

Commit 75d3600

Browse files
mdickinsonmdickinson
committed
Issue #14700: Fix buggy overflow checks for large precision and width in new-style and old-style formatting.
1 parent 08114d4 commit 75d3600

7 files changed

Lines changed: 74 additions & 22 deletions

File tree

‎Lib/test/test_str.py‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,18 @@ def test_formatting(self):
3535
string_tests.MixinStrUnicodeUserStringTest.test_formatting(self)
3636
self.assertRaises(OverflowError, '%c'.__mod__, 0x1234)
3737

38+
@test_support.cpython_only
39+
def test_formatting_huge_precision(self):
40+
from _testcapi import INT_MAX
41+
format_string = "%.{}f".format(INT_MAX + 1)
42+
with self.assertRaises(ValueError):
43+
result = format_string % 2.34
44+
45+
def test_formatting_huge_width(self):
46+
format_string = "%{}f".format(sys.maxsize + 1)
47+
with self.assertRaises(ValueError):
48+
result = format_string % 2.34
49+
3850
def test_conversion(self):
3951
# Make sure __str__() behaves properly
4052
class Foo0:
@@ -371,6 +383,21 @@ def __format__(self, format_spec):
371383
self.assertRaises(ValueError, format, "", "-")
372384
self.assertRaises(ValueError, "{0:=s}".format, '')
373385

386+
def test_format_huge_precision(self):
387+
format_string = ".{}f".format(sys.maxsize + 1)
388+
with self.assertRaises(ValueError):
389+
result = format(2.34, format_string)
390+
391+
def test_format_huge_width(self):
392+
format_string = "{}f".format(sys.maxsize + 1)
393+
with self.assertRaises(ValueError):
394+
result = format(2.34, format_string)
395+
396+
def test_format_huge_item_number(self):
397+
format_string = "{{{}:.6f}}".format(sys.maxsize + 1)
398+
with self.assertRaises(ValueError):
399+
result = format_string.format(2.34)
400+
374401
def test_format_auto_numbering(self):
375402
class C:
376403
def __init__(self, x=100):

‎Lib/test/test_unicode.py‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -644,6 +644,18 @@ def __str__(self):
644644
return u'\u1234'
645645
self.assertEqual('%s' % Wrapper(), u'\u1234')
646646

647+
@test_support.cpython_only
648+
def test_formatting_huge_precision(self):
649+
from _testcapi import INT_MAX
650+
format_string = u"%.{}f".format(INT_MAX + 1)
651+
with self.assertRaises(ValueError):
652+
result = format_string % 2.34
653+
654+
def test_formatting_huge_width(self):
655+
format_string = u"%{}f".format(sys.maxsize + 1)
656+
with self.assertRaises(ValueError):
657+
result = format_string % 2.34
658+
647659
def test_startswith_endswith_errors(self):
648660
for meth in (u'foo'.startswith, u'foo'.endswith):
649661
with self.assertRaises(UnicodeDecodeError):
@@ -1556,6 +1568,21 @@ def __format__(self, format_spec):
15561568
# will fail
15571569
self.assertRaises(UnicodeEncodeError, "foo{0}".format, u'\u1000bar')
15581570

1571+
def test_format_huge_precision(self):
1572+
format_string = u".{}f".format(sys.maxsize + 1)
1573+
with self.assertRaises(ValueError):
1574+
result = format(2.34, format_string)
1575+
1576+
def test_format_huge_width(self):
1577+
format_string = u"{}f".format(sys.maxsize + 1)
1578+
with self.assertRaises(ValueError):
1579+
result = format(2.34, format_string)
1580+
1581+
def test_format_huge_item_number(self):
1582+
format_string = u"{{{}:.6f}}".format(sys.maxsize + 1)
1583+
with self.assertRaises(ValueError):
1584+
result = format_string.format(2.34)
1585+
15591586
def test_format_auto_numbering(self):
15601587
class C:
15611588
def __init__(self, x=100):

‎Misc/NEWS‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,9 @@ What's New in Python 2.7.4
99
Core and Builtins
1010
-----------------
1111

12+
- Issue #14700: Fix buggy overflow checks for large width and precision
13+
in string formatting operations.
14+
1215
- Issue #6074: Ensure cached bytecode files can always be updated by the
1316
user that created them, even when the source file is read-only.
1417

‎Objects/stringlib/formatter.h‎

Lines changed: 7 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -73,7 +73,7 @@ static int
7373
get_integer(STRINGLIB_CHAR **ptr, STRINGLIB_CHAR *end,
7474
Py_ssize_t *result)
7575
{
76-
Py_ssize_t accumulator, digitval, oldaccumulator;
76+
Py_ssize_t accumulator, digitval;
7777
int numdigits;
7878
accumulator = numdigits = 0;
7979
for (;;(*ptr)++, numdigits++) {
@@ -83,19 +83,17 @@ get_integer(STRINGLIB_CHAR **ptr, STRINGLIB_CHAR *end,
8383
if (digitval < 0)
8484
break;
8585
/*
86-
This trick was copied from old Unicode format code. It's cute,
87-
but would really suck on an old machine with a slow divide
88-
implementation. Fortunately, in the normal case we do not
89-
expect too many digits.
86+
Detect possible overflow before it happens:
87+
88+
accumulator * 10 + digitval > PY_SSIZE_T_MAX if and only if
89+
accumulator > (PY_SSIZE_T_MAX - digitval) / 10.
9090
*/
91-
oldaccumulator = accumulator;
92-
accumulator *= 10;
93-
if ((accumulator+10)/10 != oldaccumulator+1) {
91+
if (accumulator > (PY_SSIZE_T_MAX - digitval) / 10) {
9492
PyErr_Format(PyExc_ValueError,
9593
"Too many decimal digits in format string");
9694
return -1;
9795
}
98-
accumulator += digitval;
96+
accumulator = accumulator * 10 + digitval;
9997
}
10098
*result = accumulator;
10199
return numdigits;

‎Objects/stringlib/string_format.h‎

Lines changed: 6 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -197,7 +197,6 @@ get_integer(const SubString *str)
197197
{
198198
Py_ssize_t accumulator = 0;
199199
Py_ssize_t digitval;
200-
Py_ssize_t oldaccumulator;
201200
STRINGLIB_CHAR *p;
202201

203202
/* empty string is an error */
@@ -209,19 +208,17 @@ get_integer(const SubString *str)
209208
if (digitval < 0)
210209
return -1;
211210
/*
212-
This trick was copied from old Unicode format code. It's cute,
213-
but would really suck on an old machine with a slow divide
214-
implementation. Fortunately, in the normal case we do not
215-
expect too many digits.
211+
Detect possible overflow before it happens:
212+
213+
accumulator * 10 + digitval > PY_SSIZE_T_MAX if and only if
214+
accumulator > (PY_SSIZE_T_MAX - digitval) / 10.
216215
*/
217-
oldaccumulator = accumulator;
218-
accumulator *= 10;
219-
if ((accumulator+10)/10 != oldaccumulator+1) {
216+
if (accumulator > (PY_SSIZE_T_MAX - digitval) / 10) {
220217
PyErr_Format(PyExc_ValueError,
221218
"Too many decimal digits in format string");
222219
return -1;
223220
}
224-
accumulator += digitval;
221+
accumulator = accumulator * 10 + digitval;
225222
}
226223
return accumulator;
227224
}

‎Objects/stringobject.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4369,7 +4369,7 @@ PyString_Format(PyObject *format, PyObject *args)
43694369
c = Py_CHARMASK(*fmt++);
43704370
if (!isdigit(c))
43714371
break;
4372-
if ((width*10) / 10 != width) {
4372+
if (width > (PY_SSIZE_T_MAX - ((int)c - '0')) / 10) {
43734373
PyErr_SetString(
43744374
PyExc_ValueError,
43754375
"width too big");
@@ -4404,7 +4404,7 @@ PyString_Format(PyObject *format, PyObject *args)
44044404
c = Py_CHARMASK(*fmt++);
44054405
if (!isdigit(c))
44064406
break;
4407-
if ((prec*10) / 10 != prec) {
4407+
if (prec > (INT_MAX - ((int)c - '0')) / 10) {
44084408
PyErr_SetString(
44094409
PyExc_ValueError,
44104410
"prec too big");

‎Objects/unicodeobject.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8394,7 +8394,7 @@ PyObject *PyUnicode_Format(PyObject *format,
83948394
c = *fmt++;
83958395
if (c < '0' || c > '9')
83968396
break;
8397-
if ((width*10) / 10 != width) {
8397+
if (width > (PY_SSIZE_T_MAX - ((int)c - '0')) / 10) {
83988398
PyErr_SetString(PyExc_ValueError,
83998399
"width too big");
84008400
goto onError;
@@ -8427,7 +8427,7 @@ PyObject *PyUnicode_Format(PyObject *format,
84278427
c = *fmt++;
84288428
if (c < '0' || c > '9')
84298429
break;
8430-
if ((prec*10) / 10 != prec) {
8430+
if (prec > (INT_MAX - ((int)c - '0')) / 10) {
84318431
PyErr_SetString(PyExc_ValueError,
84328432
"prec too big");
84338433
goto onError;

0 commit comments

Comments
 (0)