From: Benjamin Peterson <benjamin@python.org>
Date: Mon, 7 Jun 2010 22:27:32 +0000 (+0000)
Subject: Merged revisions 81820 via svnmerge from
X-Git-Tag: v2.6.6rc1~206
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=c971913f849d6c6672821a54a069392a1f7e77f6;p=python

Merged revisions 81820 via svnmerge from
svn+ssh://pythondev@svn.python.org/python/trunk

........
  r81820 | benjamin.peterson | 2010-06-07 17:23:23 -0500 (Mon, 07 Jun 2010) | 1 line

  correctly overflow when indexes are too large
........
---

diff --git a/Lib/test/test_unicode.py b/Lib/test/test_unicode.py
index 6f6e96fba0..7c7b96e15a 100644
--- a/Lib/test/test_unicode.py
+++ b/Lib/test/test_unicode.py
@@ -1103,6 +1103,9 @@ class UnicodeTest(
         self.assertRaises(ValueError, u"{:}".format)
         self.assertRaises(ValueError, u"{:s}".format)
         self.assertRaises(ValueError, u"{}".format)
+        big = "23098475029384702983476098230754973209482573"
+        self.assertRaises(ValueError, ("{" + big + "}").format)
+        self.assertRaises(ValueError, ("{[" + big + "]}").format, [0])
 
         # issue 6089
         self.assertRaises(ValueError, u"{0[0]x}".format, [None])
diff --git a/Misc/NEWS b/Misc/NEWS
index 8fe20710d2..511f147395 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -18,6 +18,9 @@ Core and Builtins
   when turned into an exception: in this case the exception simply
   gets ignored.
 
+- In the unicode/str.format(), raise a ValueError when either indexes to
+  arguments are too large.
+
 - Issue #3798: Write sys.exit() message to sys.stderr to use stderr encoding
   and error handler, instead of writing to the C stderr file in utf-8
 
diff --git a/Objects/stringlib/string_format.h b/Objects/stringlib/string_format.h
index 42ead89cc5..70438660d6 100644
--- a/Objects/stringlib/string_format.h
+++ b/Objects/stringlib/string_format.h
@@ -327,6 +327,8 @@ FieldNameIterator_next(FieldNameIterator *self, int *is_attribute,
         if (_FieldNameIterator_item(self, name) == 0)
             return 0;
         *name_idx = get_integer(name);
+        if (*name_idx == -1 && PyErr_Occurred())
+            return 0;
         break;
     default:
         /* Invalid character follows ']' */
@@ -380,6 +382,8 @@ field_name_split(STRINGLIB_CHAR *ptr, Py_ssize_t len, SubString *first,
 
     /* see if "first" is an integer, in which case it's used as an index */
     *first_idx = get_integer(first);
+    if (*first_idx == -1 && PyErr_Occurred())
+        return 0;
 
     /* zero length string is an error */
     if (first->ptr >= first->end) {