Issue #23055: Fixed read-past-the-end error in PyUnicode_FromFormatV.

diff --git a/Objects/unicodeobject.c b/Objects/unicodeobject.c
index 1e3b812528b773ad3ce05254f8989d310501ed9c..91e75244bf4be33de9640c6de6d9fcb573796cd4 100644 (file)
--- a/Objects/unicodeobject.c
+++ b/Objects/unicodeobject.c
@@ -738,6 +738,8 @@ PyUnicode_FromFormatV(const char *format, va_list vargs)
              f++;
              while (*f && *f != '%' && !isalpha((unsigned)*f))
                  f++;
+             if (!*f)
+                 break;
              if (*f == 's' || *f=='S' || *f=='R')
                  ++callcount;
          }