gh-95876: Fix format string in pegen error location code (#95877)

tiran · web-flow · commit b4c857d0fd74 · 2022-08-11T09:55:57.000+01:00
diff --git a/Misc/NEWS.d/next/Core and Builtins/2022-08-11-09-19-55.gh-issue-95876.YpQfoV.rst b/Misc/NEWS.d/next/Core and Builtins/2022-08-11-09-19-55.gh-issue-95876.YpQfoV.rst
@@ -0,0 +1,4 @@
+Fix format string in ``_PyPegen_raise_error_known_location`` that can lead
+to memory corruption on some 64bit systems. The function was building a
+tuple with ``i`` (int) instead of ``n`` (Py_ssize_t) for Py_ssize_t
+arguments.
diff --git a/Parser/pegen_errors.c b/Parser/pegen_errors.c
@@ -371,7 +371,7 @@ _PyPegen_raise_error_known_location(Parser *p, PyObject *errtype,
             }
         }
     }
-    tmp = Py_BuildValue("(OiiNii)", p->tok->filename, lineno, col_number, error_line, end_lineno, end_col_number);
+    tmp = Py_BuildValue("(OnnNnn)", p->tok->filename, lineno, col_number, error_line, end_lineno, end_col_number);
     if (!tmp) {
         goto error;
     }

Original file line number	Diff line number	Diff line change
`@@ -371,7 +371,7 @@ _PyPegen_raise_error_known_location(Parser p, PyObject errtype,`
`371`	`371`	`}`
`372`	`372`	`}`
`373`	`373`	`}`
`374`		`- tmp = Py_BuildValue("(OiiNii)", p->tok->filename, lineno, col_number, error_line, end_lineno, end_col_number);`
	`374`	`+ tmp = Py_BuildValue("(OnnNnn)", p->tok->filename, lineno, col_number, error_line, end_lineno, end_col_number);`
`375`	`375`	`if (!tmp) {`
`376`	`376`	`goto error;`
`377`	`377`	`}`