From 79f57833f3df0d2f3dd08639f436113286ee6067 Mon Sep 17 00:00:00 2001 From: =?utf8?q?Marc-Andr=C3=A9=20Lemburg?= Date: Sun, 29 Dec 2002 19:44:06 +0000 Subject: [PATCH] Patch for bug #659709: bogus computation of float length Python 2.2.x backport candidate. (This bug has been around since Python 1.6.) --- Lib/test/test_string.py | 26 ++++++++++++++++++++++++++ Lib/test/test_unicode.py | 25 +++++++++++++++++++++++++ Objects/stringobject.c | 22 ++++++++++++++++------ Objects/unicodeobject.c | 31 +++++++++++++++++++++---------- 4 files changed, 88 insertions(+), 16 deletions(-) diff --git a/Lib/test/test_string.py b/Lib/test/test_string.py index a30cdbd9c3..6361f786f7 100644 --- a/Lib/test/test_string.py +++ b/Lib/test/test_string.py @@ -57,3 +57,29 @@ string_tests.run_inplace_tests(str) string.whitespace string.lowercase string.uppercase + +# Float formatting +for prec in range(100): + formatstring = u'%%.%if' % prec + value = 0.01 + for x in range(60): + value = value * 3.141592655 / 3.0 * 10.0 + #print 'Overflow check for x=%i and prec=%i:' % \ + # (x, prec), + try: + result = formatstring % value + except OverflowError: + # The formatfloat() code in stringobject.c and + # unicodeobject.c uses a 120 byte buffer and switches from + # 'f' formatting to 'g' at precision 50, so we expect + # OverflowErrors for the ranges x < 50 and prec >= 67. + if x >= 50 or \ + prec < 67: + print '*** unexpected OverflowError for x=%i and prec=%i' % (x, prec) + else: + #print 'OverflowError' + pass + else: + #print result + pass + diff --git a/Lib/test/test_unicode.py b/Lib/test/test_unicode.py index 66a7f916c4..2a94586cb9 100644 --- a/Lib/test/test_unicode.py +++ b/Lib/test/test_unicode.py @@ -476,6 +476,31 @@ for ordinal in (-100, 0x200000): else: print '*** formatting u"%%c" %% %i should give a ValueError' % ordinal +# float formatting +for prec in range(100): + formatstring = u'%%.%if' % prec + value = 0.01 + for x in range(60): + value = value * 3.141592655 / 3.0 * 10.0 + #print 'Overflow check for x=%i and prec=%i:' % \ + # (x, prec), + try: + result = formatstring % value + except OverflowError: + # The formatfloat() code in stringobject.c and + # unicodeobject.c uses a 120 byte buffer and switches from + # 'f' formatting to 'g' at precision 50, so we expect + # OverflowErrors for the ranges x < 50 and prec >= 67. + if x >= 50 or \ + prec < 67: + print '*** unexpected OverflowError for x=%i and prec=%i' % (x, prec) + else: + #print 'OverflowError' + pass + else: + #print result + pass + # formatting jobs delegated from the string implementation: verify('...%(foo)s...' % {'foo':u"abc"} == u'...abc...') verify('...%(foo)s...' % {'foo':"abc"} == '...abc...') diff --git a/Objects/stringobject.c b/Objects/stringobject.c index 1e42856729..748592ea50 100644 --- a/Objects/stringobject.c +++ b/Objects/stringobject.c @@ -3361,21 +3361,31 @@ formatfloat(char *buf, size_t buflen, int flags, prec = 6; if (type == 'f' && fabs(x)/1e25 >= 1e25) type = 'g'; - PyOS_snprintf(fmt, sizeof(fmt), "%%%s.%d%c", - (flags&F_ALT) ? "#" : "", - prec, type); - /* worst case length calc to ensure no buffer overrun: + /* Worst case length calc to ensure no buffer overrun: + + 'g' formats: fmt = %#.g buf = '-' + [0-9]*prec + '.' + 'e+' + (longest exp for any double rep.) len = 1 + prec + 1 + 2 + 5 = 9 + prec + + 'f' formats: + buf = '-' + [0-9]*x + '.' + [0-9]*prec (with x < 50) + len = 1 + 50 + 1 + prec = 52 + prec + If prec=0 the effective precision is 1 (the leading digit is - always given), therefore increase by one to 10+prec. */ - if (buflen <= (size_t)10 + (size_t)prec) { + always given), therefore increase the length by one. + + */ + if ((type == 'g' && buflen <= (size_t)10 + (size_t)prec) || + (type == 'f' && buflen <= (size_t)53 + (size_t)prec)) { PyErr_SetString(PyExc_OverflowError, "formatted float is too long (precision too large?)"); return -1; } + PyOS_snprintf(fmt, sizeof(fmt), "%%%s.%d%c", + (flags&F_ALT) ? "#" : "", + prec, type); PyOS_snprintf(buf, buflen, fmt, x); return strlen(buf); } diff --git a/Objects/unicodeobject.c b/Objects/unicodeobject.c index 8565fb1545..8dcec514c7 100644 --- a/Objects/unicodeobject.c +++ b/Objects/unicodeobject.c @@ -5999,20 +5999,31 @@ formatfloat(Py_UNICODE *buf, prec = 6; if (type == 'f' && (fabs(x) / 1e25) >= 1e25) type = 'g'; - PyOS_snprintf(fmt, sizeof(fmt), "%%%s.%d%c", - (flags & F_ALT) ? "#" : "", prec, type); - /* worst case length calc to ensure no buffer overrun: - fmt = %#.g - buf = '-' + [0-9]*prec + '.' + 'e+' + (longest exp - for any double rep.) - len = 1 + prec + 1 + 2 + 5 = 9 + prec + /* Worst case length calc to ensure no buffer overrun: + + 'g' formats: + fmt = %#.g + buf = '-' + [0-9]*prec + '.' + 'e+' + (longest exp + for any double rep.) + len = 1 + prec + 1 + 2 + 5 = 9 + prec + + 'f' formats: + buf = '-' + [0-9]*x + '.' + [0-9]*prec (with x < 50) + len = 1 + 50 + 1 + prec = 52 + prec + If prec=0 the effective precision is 1 (the leading digit is - always given), therefore increase by one to 10+prec. */ - if (buflen <= (size_t)10 + (size_t)prec) { + always given), therefore increase the length by one. + + */ + if ((type == 'g' && buflen <= (size_t)10 + (size_t)prec) || + (type == 'f' && buflen <= (size_t)53 + (size_t)prec)) { PyErr_SetString(PyExc_OverflowError, - "formatted float is too long (precision too long?)"); + "formatted float is too long (precision too large?)"); return -1; } + PyOS_snprintf(fmt, sizeof(fmt), "%%%s.%d%c", + (flags&F_ALT) ? "#" : "", + prec, type); return usprintf(buf, fmt, x); } -- 2.49.0