Issue #23055: Fixed read-past-the-end error in PyUnicode_FromFormatV.

serhiy-storchaka · serhiy-storchaka · commit 0d250d117c3b · 2015-01-31T01:15:29.000+02:00
diff --git a/Objects/unicodeobject.c b/Objects/unicodeobject.c
@@ -738,6 +738,8 @@ PyUnicode_FromFormatV(const char *format, va_list vargs)
              f++;
              while (*f && *f != '%' && !isalpha((unsigned)*f))
                  f++;
+             if (!*f)
+                 break;
              if (*f == 's' || *f=='S' || *f=='R')
                  ++callcount;
          }

Original file line number	Diff line number	Diff line change
`@@ -738,6 +738,8 @@ PyUnicode_FromFormatV(const char *format, va_list vargs)`
`738`	`738`	`f++;`
`739`	`739`	`while (f && f != '%' && !isalpha((unsigned)*f))`
`740`	`740`	`f++;`
	`741`	`+ if (!*f)`
	`742`	`+ break;`
`741`	`743`	`if (f == 's' \|\| f=='S' \|\| *f=='R')`
`742`	`744`	`++callcount;`
`743`	`745`	`}`