Issue #24917: time_strftime() buffer over-read.

zooba · zooba · commit aa2fcc6b35e9 · 2015-09-06T22:18:36.000-07:00
diff --git a/Misc/NEWS b/Misc/NEWS
@@ -81,6 +81,8 @@ Core and Builtins
 Library
 -------
 
+- Issue #24917: time_strftime() buffer over-read.
+
 - Issue #23144: Make sure that HTMLParser.feed() returns all the data, even
   when convert_charrefs is True.
 
diff --git a/Modules/timemodule.c b/Modules/timemodule.c
@@ -655,6 +655,8 @@ time_strftime(PyObject *self, PyObject *args)
         outbuf != NULL;
         outbuf = wcschr(outbuf+2, '%'))
     {
+        if (outbuf[1] == L'\0')
+            break;
         /* Issue #19634: On AIX, wcsftime("y", (1899, 1, 1, 0, 0, 0, 0, 0, 0))
            returns "0/" instead of "99" */
         if (outbuf[1] == L'y' && buf.tm_year < 0) {

Original file line number	Diff line number	Diff line change
`@@ -655,6 +655,8 @@ time_strftime(PyObject self, PyObject args)`
`655`	`655`	`outbuf != NULL;`
`656`	`656`	`outbuf = wcschr(outbuf+2, '%'))`
`657`	`657`	`{`
	`658`	`+ if (outbuf[1] == L'\0')`
	`659`	`+ break;`
`658`	`660`	`/* Issue #19634: On AIX, wcsftime("y", (1899, 1, 1, 0, 0, 0, 0, 0, 0))`
`659`	`661`	`returns "0/" instead of "99" */`
`660`	`662`	`if (outbuf[1] == L'y' && buf.tm_year < 0) {`