Merge from 3.5.0 release branch
diff --git a/Lib/test/test_time.py b/Lib/test/test_time.py
index 6334e02..3f571a0 100644
--- a/Lib/test/test_time.py
+++ b/Lib/test/test_time.py
@@ -174,6 +174,12 @@
def test_strftime_bounding_check(self):
self._bounds_checking(lambda tup: time.strftime('', tup))
+ def test_strftime_format_check(self):
+ for x in [ '', 'A', '%A', '%AA' ]:
+ for y in range(0x0, 0x10):
+ for z in [ '%', 'A%', 'AA%', '%A%', 'A%A%', '%#' ]:
+ self.assertRaises(ValueError, time.strftime, x * y + z)
+
def test_default_values_for_zero(self):
# Make sure that using all zeros uses the proper default
# values. No test for daylight savings since strftime() does
diff --git a/Misc/NEWS b/Misc/NEWS
index 5f23605..3299322 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -95,6 +95,8 @@
Library
-------
+- Issue #24917: time_strftime() Buffer Over-read. Patch by John Leitch.
+
- Issue #24635: Fixed a bug in typing.py where isinstance([], typing.Iterable)
would return True once, then False on subsequent calls.
diff --git a/Modules/timemodule.c b/Modules/timemodule.c
index 197d2c0..55e26fa 100644
--- a/Modules/timemodule.c
+++ b/Modules/timemodule.c
@@ -623,6 +623,12 @@
Py_DECREF(format);
return NULL;
}
+ else if (outbuf[1] == '\0')
+ {
+ PyErr_SetString(PyExc_ValueError, "Incomplete format string");
+ Py_DECREF(format);
+ return NULL;
+ }
}
#elif (defined(_AIX) || defined(sun)) && defined(HAVE_WCSFTIME)
for(outbuf = wcschr(fmt, '%');
@@ -636,6 +642,12 @@
"format %y requires year >= 1900 on AIX");
return NULL;
}
+ else if (outbuf[1] == '\0')
+ {
+ PyErr_SetString(PyExc_ValueError, "Incomplete format string");
+ Py_DECREF(format);
+ return NULL;
+ }
}
#endif