[issue24917] time_strftime() Buffer Over-read

eryksun report at bugs.python.org
Sun Sep 6 08:57:19 CEST 2015


eryksun added the comment:

> MSVC seems somewhat inconsistent about its response:
> >>> strftime('aaa%')
> ''

That's not due to MSVC. It's setting errno to EINVAL. The problem is that time_strftime is testing (buflen > 0 || i >= 256 * fmtlen). The initial value of the outbuf size i is 1024, so when (fmtlen <= 4), the value of (256 * fmtlen) is less than or equal to i, and it assumes "the format yields an empty result" without considering the value of errno. So instead of raising an exception for EINVAL, it calls PyUnicode_DecodeLocaleAndSize to return an empty string:

    >>> strftime('aaa%')
    Breakpoint 1 hit
    ucrtbase!strftime:
    000007fe`e2bac3e0 4883ec38        sub     rsp,38h
    0:000> gu
    python35!time_strftime+0x1f5:
    00000000`5de9c785 488bcb          mov     rcx,rbx
    0:000> be 0; g
    Breakpoint 0 hit
    ucrtbase!_errno:
    000007fe`e2b341b0 48895c2408      mov     qword ptr [rsp+8],rbx ss:00000000`0028f320=ffffffffffffffff

errno is 22:

    0:000> pt; dd @rax l1
    00000000`002ddb50  00000016
    0:000> bd 0; g
    Breakpoint 2 hit
    python35!PyUnicode_DecodeLocaleAndSize:
    00000000`5df55070 4053            push    rbx
    0:000> k 2
    Child-SP          RetAddr           Call Site
    00000000`0028f318 00000000`5de9c81a python35!PyUnicode_DecodeLocaleAndSize
    00000000`0028f320 00000000`5df1d5c2 python35!time_strftime+0x28a
    0:000> g
    ''

----------

_______________________________________
Python tracker <report at bugs.python.org>
<http://bugs.python.org/issue24917>
_______________________________________


More information about the Python-bugs-list mailing list