bpo-35552: Fix reading past the end in PyUnicode_FromFormat() and PyBytes_FromFormat(). (GH-11276)
Format characters "%s" and "%V" in PyUnicode_FromFormat() and "%s" in PyBytes_FromFormat()
no longer read memory past the limit if precision is specified.
diff --git a/Objects/bytesobject.c b/Objects/bytesobject.c
index 40ef471..b299d48 100644
--- a/Objects/bytesobject.c
+++ b/Objects/bytesobject.c
@@ -312,9 +312,15 @@
Py_ssize_t i;
p = va_arg(vargs, const char*);
- i = strlen(p);
- if (prec > 0 && i > prec)
- i = prec;
+ if (prec <= 0) {
+ i = strlen(p);
+ }
+ else {
+ i = 0;
+ while (i < prec && p[i]) {
+ i++;
+ }
+ }
s = _PyBytesWriter_WriteBytes(&writer, s, p, i);
if (s == NULL)
goto error;