commit 75d36004665a637c5d0aa868a5d0b728b3d03d39
author Mark Dickinson <mdickinson@enthought.com> Sun Oct 28 10:00:46 2012 +0000
committer Mark Dickinson <mdickinson@enthought.com> Sun Oct 28 10:00:46 2012 +0000
tree eaae340a81386d4ca660f446cd69f586bf7b10a9
parent 08114d40e94fa97ac9a55b80b69dc269da904fcc

Issue #14700: Fix buggy overflow checks for large precision and width in new-style and old-style formatting.

Objects/unicodeobject.c

diff --git a/Objects/unicodeobject.c b/Objects/unicodeobject.c
index e3c2cb1..79b87df 100644
--- a/Objects/unicodeobject.c
+++ b/Objects/unicodeobject.c
@@ -8394,7 +8394,7 @@
                     c = *fmt++;
                     if (c < '0' || c > '9')
                         break;
-                    if ((width*10) / 10 != width) {
+                    if (width > (PY_SSIZE_T_MAX - ((int)c - '0')) / 10) {
                         PyErr_SetString(PyExc_ValueError,
                                         "width too big");
                         goto onError;
@@ -8427,7 +8427,7 @@
                         c = *fmt++;
                         if (c < '0' || c > '9')
                             break;
-                        if ((prec*10) / 10 != prec) {
+                        if (prec > (INT_MAX - ((int)c - '0')) / 10) {
                             PyErr_SetString(PyExc_ValueError,
                                             "prec too big");
                             goto onError;