Issue #24917: time_strftime() Buffer Over-read. Patch by John Leitch.

zooba · zooba · commit 0fba9b324f06 · 2015-09-05T20:55:34.000-07:00
diff --git a/Misc/NEWS b/Misc/NEWS
@@ -84,6 +84,8 @@ Library
 - Issue #16180: Exit pdb if file has syntax error, instead of trapping user
   in an infinite loop.  Patch by Xavier de Gaye.
 
+- Issue #24917: time_strftime() Buffer Over-read. Patch by John Leitch.
+
 - Issue #21112: Fix regression in unittest.expectedFailure on subclasses.
   Patch from Berker Peksag.
 
diff --git a/Modules/timemodule.c b/Modules/timemodule.c
@@ -662,6 +662,12 @@ time_strftime(PyObject *self, PyObject *args)
                             "format %y requires year >= 1900 on AIX");
             return NULL;
         }
+        else if (outbuf[1] == '\0')
+        {
+            PyErr_SetString(PyExc_ValueError, "Incomplete format string");
+            Py_DECREF(format);
+            return NULL;
+        }
     }
 #endif
 

Original file line number	Diff line number	Diff line change
`@@ -662,6 +662,12 @@ time_strftime(PyObject self, PyObject args)`
`662`	`662`	`"format %y requires year >= 1900 on AIX");`
`663`	`663`	`return NULL;`
`664`	`664`	`}`
	`665`	`+ else if (outbuf[1] == '\0')`
	`666`	`+ {`
	`667`	`+ PyErr_SetString(PyExc_ValueError, "Incomplete format string");`
	`668`	`+ Py_DECREF(format);`
	`669`	`+ return NULL;`
	`670`	`+ }`
`665`	`671`	`}`
`666`	`672`	`#endif`
`667`	`673`