Should check that PyObject_Str() really returned a string!

diff --git a/Objects/stringobject.c b/Objects/stringobject.c
index 5e6a5a5938d70b8881b7a7a3a8f4ad2160844f95..dffc8e0e1a4a1ec747cad0bd3d8adc092adb134a 100644 (file)
--- a/Objects/stringobject.c
+++ b/Objects/stringobject.c
@@ -900,6 +900,11 @@ PyString_Format(format, args)
                                temp = PyObject_Str(v);
                                if (temp == NULL)
                                        goto error;
+                               if (!PyString_Check(temp)) {
+                                       PyErr_SetString(PyExc_TypeError,
+                                         "%s argument has non-string str()");
+                                       goto error;
+                               }
                                buf = PyString_AsString(temp);
                                len = PyString_Size(temp);
                                if (prec >= 0 && len > prec)