Issue #14700: Fix two broken and undefined-behaviour-inducing overflow checks in...

diff --git a/Lib/test/string_tests.py b/Lib/test/string_tests.py
index b7246ebf39c694ba174bb7ffc29ef986ecee2615..eeeb457ede31c67f9831db8ce9f5a371aa321007 100644 (file)
--- a/Lib/test/string_tests.py
+++ b/Lib/test/string_tests.py
@@ -1197,6 +1197,10 @@ class MixinStrUnicodeUserStringTest:
         self.checkraises(TypeError, '%10.*f', '__mod__', ('foo', 42.))
         self.checkraises(ValueError, '%10', '__mod__', (42,))
 
+        # Outrageously large width or precision should raise ValueError.
+        self.checkraises(ValueError, '%%%df' % (2**64), '__mod__', (3.2))
+        self.checkraises(ValueError, '%%.%df' % (2**64), '__mod__', (3.2))
+
     def test_floatformatting(self):
         # float formatting
         for prec in range(100):

diff --git a/Misc/NEWS b/Misc/NEWS
index 6047785cc696e95282123b32090ea95fe0b1e0aa..809114cc2f24feef448dbe38105255b5691a0b71 100644 (file)
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -10,6 +10,9 @@ What's New in Python 3.3.0 Alpha 4?
 Core and Builtins
 -----------------
 
+- Issue #14700: Fix two broken and undefined-behaviour-inducing overflow checks
+  in old-style string formatting.
+
 - Issue #14705: The PyArg_Parse() family of functions now support the 'p' format
   unit, which accepts a "boolean predicate" argument.  It converts any Python
   value into an integer--0 if it is "false", and 1 otherwise.

diff --git a/Objects/unicodeobject.c b/Objects/unicodeobject.c
index bb0d78633d87edbbde28d6e2d2bcd0477fe19745..129a5fcefb3dccf166ad9a0c7b65a65b978a74ce 100644 (file)
--- a/Objects/unicodeobject.c
+++ b/Objects/unicodeobject.c
@@ -13933,7 +13933,7 @@ PyUnicode_Format(PyObject *format, PyObject *args)
                     c = PyUnicode_READ(fmtkind, fmt, fmtpos++);
                     if (c < '0' || c > '9')
                         break;
-                    if ((width*10) / 10 != width) {
+                    if (width > (PY_SSIZE_T_MAX - (c - '0')) / 10) {
                         PyErr_SetString(PyExc_ValueError,
                                         "width too big");
                         goto onError;
@@ -13968,7 +13968,7 @@ PyUnicode_Format(PyObject *format, PyObject *args)
                         c = PyUnicode_READ(fmtkind, fmt, fmtpos++);
                         if (c < '0' || c > '9')
                             break;
-                        if ((prec*10) / 10 != prec) {
+                        if (prec > (INT_MAX - (c - '0')) / 10) {
                             PyErr_SetString(PyExc_ValueError,
                                             "prec too big");
                             goto onError;