changeset:   87933:969e38b2f336
parent:      87931:5d078b0bae75
parent:      87932:68e0dbc492de
user:        Victor Stinner <victor.stinner@gmail.com>
date:        Fri Dec 13 12:15:31 2013 +0100
files:       Lib/test/test_bytes.py Misc/NEWS Objects/bytesobject.c
description:
(Merge 3.3) Issue #19969: PyBytes_FromFormatV() now raises an OverflowError if
"%c" argument is not in range [0; 255].


diff -r 5d078b0bae75 -r 969e38b2f336 Lib/test/test_bytes.py
--- a/Lib/test/test_bytes.py	Fri Dec 13 11:08:56 2013 +0100
+++ b/Lib/test/test_bytes.py	Fri Dec 13 12:15:31 2013 +0100
@@ -743,6 +743,12 @@
         self.assertEqual(PyBytes_FromFormat(b's:%s', c_char_p(b'cstr')),
                          b's:cstr')
 
+        # Issue #19969
+        self.assertRaises(OverflowError,
+                          PyBytes_FromFormat, b'%c', c_int(-1))
+        self.assertRaises(OverflowError,
+                          PyBytes_FromFormat, b'%c', c_int(256))
+
 
 class ByteArrayTest(BaseBytesTest, unittest.TestCase):
     type2test = bytearray
diff -r 5d078b0bae75 -r 969e38b2f336 Misc/NEWS
--- a/Misc/NEWS	Fri Dec 13 11:08:56 2013 +0100
+++ b/Misc/NEWS	Fri Dec 13 12:15:31 2013 +0100
@@ -10,6 +10,9 @@
 Core and Builtins
 -----------------
 
+- Issue #19969: PyBytes_FromFormatV() now raises an OverflowError if "%c"
+  argument is not in range [0; 255].
+
 - Issue #19787: PyThread_set_key_value() now always set the value. In Python
   3.3, the function did nothing if the key already exists (if the current value
   is a non-NULL pointer).
diff -r 5d078b0bae75 -r 969e38b2f336 Objects/bytesobject.c
--- a/Objects/bytesobject.c	Fri Dec 13 11:08:56 2013 +0100
+++ b/Objects/bytesobject.c	Fri Dec 13 12:15:31 2013 +0100
@@ -195,8 +195,17 @@
 
             switch (*f) {
             case 'c':
-                (void)va_arg(count, int);
-                /* fall through... */
+            {
+                int c = va_arg(count, int);
+                if (c < 0 || c > 255) {
+                    PyErr_SetString(PyExc_OverflowError,
+                                    "PyBytes_FromFormatV(): %c format "
+                                    "expects an integer in range [0; 255]");
+                    return NULL;
+                }
+                n++;
+                break;
+            }
             case '%':
                 n++;
                 break;
@@ -276,8 +285,12 @@
 
             switch (*f) {
             case 'c':
-                *s++ = va_arg(vargs, int);
+            {
+                int c = va_arg(vargs, int);
+                /* c has been checked for overflow in the first step */
+                *s++ = (unsigned char)c;
                 break;
+            }
             case 'd':
                 if (longflag)
                     sprintf(s, "%ld", va_arg(vargs, long));