Patch #1673759: add a missing overflow check when formatting floats

with %G.
 (backport from rev. 56298)

diff --git a/Lib/test/test_format.py b/Lib/test/test_format.py
index fee3bf4a305a002ec2a0f77c9085cc288edf3912..77670ada844688c41074f7c8536481d66650e02a 100644 (file)
--- a/Lib/test/test_format.py
+++ b/Lib/test/test_format.py
@@ -9,6 +9,7 @@ maxsize = MAX_Py_ssize_t
 # test on unicode strings as well
 
 overflowok = 1
+overflowrequired = 0
 
 def testformat(formatstr, args, output=None):
     if verbose:
@@ -25,11 +26,16 @@ def testformat(formatstr, args, output=None):
         if verbose:
             print 'overflow (this is fine)'
     else:
-        if output and result != output:
+        if overflowrequired:
             if verbose:
                 print 'no'
-            print "%s %% %s == %s != %s" %\
-                (repr(formatstr), repr(args), repr(result), repr(output))
+            print "overflow expected on %s %% %s" % \
+                  (repr(formatstr), repr(args))
+        elif output and result != output:
+            if verbose:
+                print 'no'
+            print "%s %% %s == %s != %s" % \
+                  (repr(formatstr), repr(args), repr(result), repr(output))
         else:
             if verbose:
                 print 'yes'
@@ -57,6 +63,14 @@ testboth("%#.*g", (110, -1.e+100/3.))
 # test some ridiculously large precision, expect overflow
 testboth('%12.*f', (123456, 1.0))
 
+# check for internal overflow validation on length of precision
+overflowrequired = 1
+testboth("%#.*g", (110, -1.e+100/3.))
+testboth("%#.*G", (110, -1.e+100/3.))
+testboth("%#.*f", (110, -1.e+100/3.))
+testboth("%#.*F", (110, -1.e+100/3.))
+overflowrequired = 0
+
 # Formatting of long integers. Overflow is not ok
 overflowok = 0
 testboth("%x", 10L, "a")

diff --git a/Misc/NEWS b/Misc/NEWS
index d9d2133eff49b0e242e72b73e1ce598eb9c9912b..78205ef22a907405496fe12e5eba2934cb62ce16 100644 (file)
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -12,6 +12,9 @@ What's New in Python 2.5.2c1?
 Core and builtins
 -----------------
 
+- Patch #1673759: add a missing overflow check when formatting floats
+  with %G.
+
 - Patch #1733960: Allow T_LONGLONG to accept ints.
 
 - Prevent expandtabs() on string and unicode objects from causing a segfault

diff --git a/Objects/stringobject.c b/Objects/stringobject.c
index cee78a0089f4957bd29610291bb082783127a3be..5d343bdf99b9eaed23fd29d4d8ff4634e8412187 100644 (file)
--- a/Objects/stringobject.c
+++ b/Objects/stringobject.c
@@ -4188,7 +4188,8 @@ formatfloat(char *buf, size_t buflen, int flags,
           always given), therefore increase the length by one.
 
        */
-       if ((type == 'g' && buflen <= (size_t)10 + (size_t)prec) ||
+       if (((type == 'g' || type == 'G') &&
+              buflen <= (size_t)10 + (size_t)prec) ||
            (type == 'f' && buflen <= (size_t)53 + (size_t)prec)) {
                PyErr_SetString(PyExc_OverflowError,
                        "formatted float is too long (precision too large?)");

diff --git a/Objects/unicodeobject.c b/Objects/unicodeobject.c
index 742db6ff52297a38f819a673749ff9cd1addb5b7..6cc6541af5788df8fa0e5d442fa6217c4fd5c2b7 100644 (file)
--- a/Objects/unicodeobject.c
+++ b/Objects/unicodeobject.c
@@ -7290,7 +7290,8 @@ formatfloat(Py_UNICODE *buf,
        always given), therefore increase the length by one.
 
     */
-    if ((type == 'g' && buflen <= (size_t)10 + (size_t)prec) ||
+    if (((type == 'g' || type == 'G') && 
+          buflen <= (size_t)10 + (size_t)prec) ||
        (type == 'f' && buflen <= (size_t)53 + (size_t)prec)) {
        PyErr_SetString(PyExc_OverflowError,
                        "formatted float is too long (precision too large?)");