Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 5db862d

Browse files
gvanrossumgvanrossum
committed
Skip Montanaro: add string precisions to calls to PyErr_Format
to prevent possible buffer overruns.
1 parent fa972c9 commit 5db862d

5 files changed

Lines changed: 29 additions & 27 deletions

File tree

‎Modules/pyexpat.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -307,7 +307,7 @@ xmlparse_Parse( xmlparseobject *self, PyObject *args )
307307
return NULL;
308308
}
309309
else if (rv == 0) {
310-
PyErr_Format(ErrorObject, "%s: line %i, column %i",
310+
PyErr_Format(ErrorObject, "%.200s: line %i, column %i",
311311
XML_ErrorString( XML_GetErrorCode(self->itself) ),
312312
XML_GetErrorLineNumber(self->itself),
313313
XML_GetErrorColumnNumber(self->itself) );

‎Objects/object.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -236,7 +236,7 @@ PyObject_Repr(v)
236236
return NULL;
237237
if (!PyString_Check(res)) {
238238
PyErr_Format(PyExc_TypeError,
239-
"__repr__ returned non-string (type %s)",
239+
"__repr__ returned non-string (type %.200s)",
240240
res->ob_type->tp_name);
241241
Py_DECREF(res);
242242
return NULL;
@@ -273,7 +273,7 @@ PyObject_Str(v)
273273
return NULL;
274274
if (!PyString_Check(res)) {
275275
PyErr_Format(PyExc_TypeError,
276-
"__str__ returned non-string (type %s)",
276+
"__str__ returned non-string (type %.200s)",
277277
res->ob_type->tp_name);
278278
Py_DECREF(res);
279279
return NULL;

‎Objects/unicodeobject.c‎

Lines changed: 22 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -365,7 +365,7 @@ PyObject *PyUnicode_Decode(const char *s,
365365
goto onError;
366366
if (!PyUnicode_Check(unicode)) {
367367
PyErr_Format(PyExc_TypeError,
368-
"decoder did not return an unicode object (type=%s)",
368+
"decoder did not return an unicode object (type=%.400s)",
369369
unicode->ob_type->tp_name);
370370
Py_DECREF(unicode);
371371
goto onError;
@@ -416,7 +416,7 @@ PyObject *PyUnicode_AsEncodedString(PyObject *unicode,
416416
/* XXX Should we really enforce this ? */
417417
if (!PyString_Check(v)) {
418418
PyErr_Format(PyExc_TypeError,
419-
"encoder did not return a string object (type=%s)",
419+
"encoder did not return a string object (type=%.400s)",
420420
v->ob_type->tp_name);
421421
Py_DECREF(v);
422422
goto onError;
@@ -484,7 +484,7 @@ int utf8_decoding_error(const char **source,
484484
if ((errors == NULL) ||
485485
(strcmp(errors,"strict") == 0)) {
486486
PyErr_Format(PyExc_UnicodeError,
487-
"UTF-8 decoding error: %s",
487+
"UTF-8 decoding error: %.400s",
488488
details);
489489
return -1;
490490
}
@@ -500,7 +500,7 @@ int utf8_decoding_error(const char **source,
500500
}
501501
else {
502502
PyErr_Format(PyExc_ValueError,
503-
"UTF-8 decoding error; unknown error handling code: %s",
503+
"UTF-8 decoding error; unknown error handling code: %.400s",
504504
errors);
505505
return -1;
506506
}
@@ -607,7 +607,7 @@ int utf8_encoding_error(const Py_UNICODE **source,
607607
if ((errors == NULL) ||
608608
(strcmp(errors,"strict") == 0)) {
609609
PyErr_Format(PyExc_UnicodeError,
610-
"UTF-8 encoding error: %s",
610+
"UTF-8 encoding error: %.400s",
611611
details);
612612
return -1;
613613
}
@@ -622,7 +622,7 @@ int utf8_encoding_error(const Py_UNICODE **source,
622622
else {
623623
PyErr_Format(PyExc_ValueError,
624624
"UTF-8 encoding error; "
625-
"unknown error handling code: %s",
625+
"unknown error handling code: %.400s",
626626
errors);
627627
return -1;
628628
}
@@ -728,7 +728,7 @@ int utf16_decoding_error(const Py_UNICODE **source,
728728
if ((errors == NULL) ||
729729
(strcmp(errors,"strict") == 0)) {
730730
PyErr_Format(PyExc_UnicodeError,
731-
"UTF-16 decoding error: %s",
731+
"UTF-16 decoding error: %.400s",
732732
details);
733733
return -1;
734734
}
@@ -744,7 +744,7 @@ int utf16_decoding_error(const Py_UNICODE **source,
744744
}
745745
else {
746746
PyErr_Format(PyExc_ValueError,
747-
"UTF-16 decoding error; unknown error handling code: %s",
747+
"UTF-16 decoding error; unknown error handling code: %.400s",
748748
errors);
749749
return -1;
750750
}
@@ -918,7 +918,7 @@ int unicodeescape_decoding_error(const char **source,
918918
if ((errors == NULL) ||
919919
(strcmp(errors,"strict") == 0)) {
920920
PyErr_Format(PyExc_UnicodeError,
921-
"Unicode-Escape decoding error: %s",
921+
"Unicode-Escape decoding error: %.400s",
922922
details);
923923
return -1;
924924
}
@@ -932,7 +932,7 @@ int unicodeescape_decoding_error(const char **source,
932932
else {
933933
PyErr_Format(PyExc_ValueError,
934934
"Unicode-Escape decoding error; "
935-
"unknown error handling code: %s",
935+
"unknown error handling code: %.400s",
936936
errors);
937937
return -1;
938938
}
@@ -1296,7 +1296,7 @@ int latin1_encoding_error(const Py_UNICODE **source,
12961296
if ((errors == NULL) ||
12971297
(strcmp(errors,"strict") == 0)) {
12981298
PyErr_Format(PyExc_UnicodeError,
1299-
"Latin-1 encoding error: %s",
1299+
"Latin-1 encoding error: %.400s",
13001300
details);
13011301
return -1;
13021302
}
@@ -1310,7 +1310,7 @@ int latin1_encoding_error(const Py_UNICODE **source,
13101310
else {
13111311
PyErr_Format(PyExc_ValueError,
13121312
"Latin-1 encoding error; "
1313-
"unknown error handling code: %s",
1313+
"unknown error handling code: %.400s",
13141314
errors);
13151315
return -1;
13161316
}
@@ -1366,7 +1366,7 @@ int ascii_decoding_error(const char **source,
13661366
if ((errors == NULL) ||
13671367
(strcmp(errors,"strict") == 0)) {
13681368
PyErr_Format(PyExc_UnicodeError,
1369-
"ASCII decoding error: %s",
1369+
"ASCII decoding error: %.400s",
13701370
details);
13711371
return -1;
13721372
}
@@ -1381,7 +1381,7 @@ int ascii_decoding_error(const char **source,
13811381
else {
13821382
PyErr_Format(PyExc_ValueError,
13831383
"ASCII decoding error; "
1384-
"unknown error handling code: %s",
1384+
"unknown error handling code: %.400s",
13851385
errors);
13861386
return -1;
13871387
}
@@ -1429,7 +1429,7 @@ int ascii_encoding_error(const Py_UNICODE **source,
14291429
if ((errors == NULL) ||
14301430
(strcmp(errors,"strict") == 0)) {
14311431
PyErr_Format(PyExc_UnicodeError,
1432-
"ASCII encoding error: %s",
1432+
"ASCII encoding error: %.400s",
14331433
details);
14341434
return -1;
14351435
}
@@ -1443,7 +1443,7 @@ int ascii_encoding_error(const Py_UNICODE **source,
14431443
else {
14441444
PyErr_Format(PyExc_ValueError,
14451445
"ASCII encoding error; "
1446-
"unknown error handling code: %s",
1446+
"unknown error handling code: %.400s",
14471447
errors);
14481448
return -1;
14491449
}
@@ -1558,7 +1558,7 @@ int charmap_decoding_error(const char **source,
15581558
if ((errors == NULL) ||
15591559
(strcmp(errors,"strict") == 0)) {
15601560
PyErr_Format(PyExc_UnicodeError,
1561-
"charmap decoding error: %s",
1561+
"charmap decoding error: %.400s",
15621562
details);
15631563
return -1;
15641564
}
@@ -1573,7 +1573,7 @@ int charmap_decoding_error(const char **source,
15731573
else {
15741574
PyErr_Format(PyExc_ValueError,
15751575
"charmap decoding error; "
1576-
"unknown error handling code: %s",
1576+
"unknown error handling code: %.400s",
15771577
errors);
15781578
return -1;
15791579
}
@@ -1674,7 +1674,7 @@ int charmap_encoding_error(const Py_UNICODE **source,
16741674
if ((errors == NULL) ||
16751675
(strcmp(errors,"strict") == 0)) {
16761676
PyErr_Format(PyExc_UnicodeError,
1677-
"charmap encoding error: %s",
1677+
"charmap encoding error: %.400s",
16781678
details);
16791679
return -1;
16801680
}
@@ -1689,7 +1689,7 @@ int charmap_encoding_error(const Py_UNICODE **source,
16891689
else {
16901690
PyErr_Format(PyExc_ValueError,
16911691
"charmap encoding error; "
1692-
"unknown error handling code: %s",
1692+
"unknown error handling code: %.400s",
16931693
errors);
16941694
return -1;
16951695
}
@@ -1806,7 +1806,7 @@ int translate_error(const Py_UNICODE **source,
18061806
if ((errors == NULL) ||
18071807
(strcmp(errors,"strict") == 0)) {
18081808
PyErr_Format(PyExc_UnicodeError,
1809-
"translate error: %s",
1809+
"translate error: %.400s",
18101810
details);
18111811
return -1;
18121812
}
@@ -1821,7 +1821,7 @@ int translate_error(const Py_UNICODE **source,
18211821
else {
18221822
PyErr_Format(PyExc_ValueError,
18231823
"translate error; "
1824-
"unknown error handling code: %s",
1824+
"unknown error handling code: %.400s",
18251825
errors);
18261826
return -1;
18271827
}

‎Python/ceval.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2513,7 +2513,7 @@ call_function(func, arg, kw)
25132513
else {
25142514
if (!PyFunction_Check(func)) {
25152515
PyErr_Format(PyExc_TypeError,
2516-
"call of non-function (type %s)",
2516+
"call of non-function (type %.200s)",
25172517
func->ob_type->tp_name);
25182518
return NULL;
25192519
}

‎Python/dynload_next.c‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -185,7 +185,9 @@ dl_funcptr _PyImport_GetDynLoadFunc(const char *fqname, const char *shortname,
185185
if (!NSIsSymbolNameDefined(funcname)) {
186186
/* UnlinkModule() isn't implimented in current versions, but calling it does no harm */
187187
NSUnLinkModule(newModule, FALSE);
188-
PyErr_Format(PyExc_ImportError, "Loaded module does not contain symbol %s", funcname);
188+
PyErr_Format(PyExc_ImportError,
189+
"Loaded module does not contain symbol %.200s",
190+
funcname);
189191
return NULL;
190192
}
191193
theSym = NSLookupAndBindSymbol(funcname);

0 commit comments

Comments
 (0)