[issue23055] PyUnicode_FromFormatV crasher

[Stefan Krah]

Stefan Krah added the comment:

I think I still get a problem in 2.7:

[1/1] test_unicode
==23430== Invalid read of size 1
==23430==    at 0x484541: PyUnicodeUCS2_FromFormatV (unicodeobject.c:736)
==23430==    by 0x485C75: PyUnicodeUCS2_FromFormat (unicodeobject.c:1083)


736         for (f = format; *f; f++) {
(gdb) p format
$1 = 0x71d45f4 "%"
(gdb) p f
$2 = 0x71d45f6 ""


So format=="%", first f++ happens at 738, second f++ happens implicitly
at the end of the for loop. The *f condition in 736 is then an invalid
read.


Perhaps use while for the outer loop and a break? (It's just my
personal preference, I sometimes get confused by incrementing
at the end and also inside for loops.)

----------

_______________________________________
Python tracker <report at bugs.python.org>
<http://bugs.python.org/issue23055>
_______________________________________