Issue #16147: PyUnicode_FromFormatV() now raises an error if the argument of

'%c' is not in the range(0x110000).

diff --git a/Objects/unicodeobject.c b/Objects/unicodeobject.c
index 40e56cdced8d06b431c5ec1d63e8a4b76118f95b..e6fe1fba4e2a9c5ba9ffe91287a2fe2d33c8b8e0 100644 (file)
--- a/Objects/unicodeobject.c
+++ b/Objects/unicodeobject.c
@@ -2417,6 +2417,11 @@ unicode_fromformat_arg(_PyUnicodeWriter *writer,
     case 'c':
     {
         int ordinal = va_arg(*vargs, int);
+        if (ordinal < 0 || ordinal > MAX_UNICODE) {
+            PyErr_SetString(PyExc_ValueError,
+                            "character argument not in range(0x110000)");
+            return NULL;
+        }
         if (_PyUnicodeWriter_Prepare(writer, 1, ordinal) == -1)
             return NULL;
         PyUnicode_WRITE(writer->kind, writer->data, writer->pos, ordinal);