bpo-35552: Fix reading past the end in PyUnicode_FromFormat() and PyBytes_FromFormat(). (GH-11276)
Format characters "%s" and "%V" in PyUnicode_FromFormat() and "%s" in PyBytes_FromFormat()
no longer read memory past the limit if precision is specified.
diff --git a/Objects/unicodeobject.c b/Objects/unicodeobject.c
index 304ea74..f1d23b6 100644
--- a/Objects/unicodeobject.c
+++ b/Objects/unicodeobject.c
@@ -2578,9 +2578,15 @@
PyObject *unicode;
int res;
- length = strlen(str);
- if (precision != -1)
- length = Py_MIN(length, precision);
+ if (precision == -1) {
+ length = strlen(str);
+ }
+ else {
+ length = 0;
+ while (length < precision && str[length]) {
+ length++;
+ }
+ }
unicode = PyUnicode_DecodeUTF8Stateful(str, length, "replace", NULL);
if (unicode == NULL)
return -1;