diff options
| author | Kristján Valur Jónsson <kristjan@ccpgames.com> | 2009-02-04 10:05:25 +0000 |
|---|---|---|
| committer | Kristján Valur Jónsson <kristjan@ccpgames.com> | 2009-02-04 10:05:25 +0000 |
| commit | fd4c872726e650f1e43c4eed4fa7e7e326b3fee6 (patch) | |
| tree | 511e8c21bc40e5d71c8fd2328ff7fdbca2db8c11 /Modules/timemodule.c | |
| parent | 8bdd3b3dcf38ba1b5bd460b3c309fb6a8ea1127c (diff) | |
| download | cpython-git-fd4c872726e650f1e43c4eed4fa7e7e326b3fee6.tar.gz | |
issue 4804: Provide checks for the format string of strftime, and for the "mode" string of fopen on Windows. These strings are user provided from python and so we can avoid invoking the C runtime invalid parameter handler by first checking that they are valid.
Diffstat (limited to 'Modules/timemodule.c')
| -rw-r--r-- | Modules/timemodule.c | 17 |
1 files changed, 17 insertions, 0 deletions
diff --git a/Modules/timemodule.c b/Modules/timemodule.c index e8de2c5706..2f4092d64e 100644 --- a/Modules/timemodule.c +++ b/Modules/timemodule.c @@ -470,6 +470,23 @@ time_strftime(PyObject *self, PyObject *args) return NULL; } +#ifdef MS_WINDOWS + /* check that the format string contains only valid directives */ + for(outbuf = strchr(fmt, '%'); + outbuf != NULL; + outbuf = strchr(outbuf+2, '%')) + { + if (outbuf[1]=='#') + ++outbuf; /* not documented by python, */ + if (outbuf[1]=='\0' || + !strchr("aAbBcdfHIjmMpSUwWxXyYzZ%", outbuf[1])) + { + PyErr_SetString(PyExc_ValueError, "Invalid format string"); + return 0; + } + } +#endif + fmtlen = strlen(fmt); /* I hate these functions that presume you know how big the output |