diff options
| author | Serhiy Storchaka <storchaka@gmail.com> | 2013-01-19 12:55:39 +0200 |
|---|---|---|
| committer | Serhiy Storchaka <storchaka@gmail.com> | 2013-01-19 12:55:39 +0200 |
| commit | 74f49ab28b91d3c23524356230feb2724ee9b23f (patch) | |
| tree | 0ddd5e8899d06c974dfc25a7dfc298e3f6f70039 /Objects/unicodeobject.c | |
| parent | ac7b49f4076a4336915d13a4aa19feaeadd29d62 (diff) | |
| download | cpython-git-74f49ab28b91d3c23524356230feb2724ee9b23f.tar.gz | |
Issue #15989: Fix several occurrences of integer overflow
when result of PyInt_AsLong() or PyLong_AsLong() narrowed
to int without checks.
This is a backport of changesets 13e2e44db99d and 525407d89277.
Diffstat (limited to 'Objects/unicodeobject.c')
| -rw-r--r-- | Objects/unicodeobject.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/Objects/unicodeobject.c b/Objects/unicodeobject.c index 79e1b600e3..46bfe2b54c 100644 --- a/Objects/unicodeobject.c +++ b/Objects/unicodeobject.c @@ -8411,7 +8411,9 @@ PyObject *PyUnicode_Format(PyObject *format, "* wants int"); goto onError; } - width = PyInt_AsLong(v); + width = PyInt_AsSsize_t(v); + if (width == -1 && PyErr_Occurred()) + goto onError; if (width < 0) { flags |= F_LJUST; width = -width; @@ -8446,7 +8448,9 @@ PyObject *PyUnicode_Format(PyObject *format, "* wants int"); goto onError; } - prec = PyInt_AsLong(v); + prec = _PyInt_AsInt(v); + if (prec == -1 && PyErr_Occurred()) + goto onError; if (prec < 0) prec = 0; if (--fmtcnt >= 0) |