I'm not sure why this code allocates this string for the error message.
I think it would be better to always use snprintf and have the format
limit the size of the name appropriately (like %.200s).
Klocwork #340
diff --git a/Modules/unicodedata.c b/Modules/unicodedata.c
index 7f8592f..a11a0b7 100644
--- a/Modules/unicodedata.c
+++ b/Modules/unicodedata.c
@@ -1078,6 +1078,7 @@
{
Py_UCS4 code;
Py_UNICODE str[1];
+ char errbuf[256];
char* name;
int namelen;
@@ -1085,11 +1086,19 @@
return NULL;
if (!_getcode(self, name, namelen, &code)) {
+ /* XXX(nnorwitz): why are we allocating for the error msg?
+ Why not always use snprintf? */
char fmt[] = "undefined character name '%s'";
char *buf = PyMem_MALLOC(sizeof(fmt) + namelen);
- sprintf(buf, fmt, name);
+ if (buf)
+ sprintf(buf, fmt, name);
+ else {
+ buf = errbuf;
+ PyOS_snprintf(buf, sizeof(errbuf), fmt, name);
+ }
PyErr_SetString(PyExc_KeyError, buf);
- PyMem_FREE(buf);
+ if (buf != errbuf)
+ PyMem_FREE(buf);
return NULL;
}