[Python-checkins] python/dist/src/Objects stringobject.c,2.147.6.11,2.147.6.12 unicodeobject.c,2.124.6.18,2.124.6.19

[rhettinger@users.sourceforge.net]

Update of /cvsroot/python/python/dist/src/Objects
In directory sc8-pr-cvs1:/tmp/cvs-serv3455/Objects

Modified Files:
      Tag: release22-maint
	stringobject.c unicodeobject.c 
Log Message:
Backport MAL's patch for bug #659709: bogus computation of float length



Index: stringobject.c
===================================================================
RCS file: /cvsroot/python/python/dist/src/Objects/stringobject.c,v
retrieving revision 2.147.6.11
retrieving revision 2.147.6.12
diff -C2 -d -r2.147.6.11 -r2.147.6.12
*** stringobject.c	11 Oct 2002 00:47:19 -0000	2.147.6.11
--- stringobject.c	2 Jan 2003 22:08:34 -0000	2.147.6.12
***************
*** 3060,3078 ****
  	if (type == 'f' && fabs(x)/1e25 >= 1e25)
  		type = 'g';
! 	PyOS_snprintf(fmt, sizeof(fmt), "%%%s.%d%c",
! 		      (flags&F_ALT) ? "#" : "",
! 		      prec, type);
! 	/* worst case length calc to ensure no buffer overrun:
  	     fmt = %#.<prec>g
  	     buf = '-' + [0-9]*prec + '.' + 'e+' + (longest exp
  	        for any double rep.)
  	     len = 1 + prec + 1 + 2 + 5 = 9 + prec
  	   If prec=0 the effective precision is 1 (the leading digit is
! 	   always given), therefore increase by one to 10+prec. */
! 	if (buflen <= (size_t)10 + (size_t)prec) {
  		PyErr_SetString(PyExc_OverflowError,
  			"formatted float is too long (precision too large?)");
  		return -1;
  	}
  	PyOS_snprintf(buf, buflen, fmt, x);
  	return strlen(buf);
--- 3060,3088 ----
  	if (type == 'f' && fabs(x)/1e25 >= 1e25)
  		type = 'g';
! 	/* Worst case length calc to ensure no buffer overrun:
! 
! 	   'g' formats:
  	     fmt = %#.<prec>g
  	     buf = '-' + [0-9]*prec + '.' + 'e+' + (longest exp
  	        for any double rep.)
  	     len = 1 + prec + 1 + 2 + 5 = 9 + prec
+ 
+ 	   'f' formats:
+ 	     buf = '-' + [0-9]*x + '.' + [0-9]*prec (with x < 50)
+ 	     len = 1 + 50 + 1 + prec = 52 + prec
+ 
  	   If prec=0 the effective precision is 1 (the leading digit is
! 	   always given), therefore increase the length by one. 
! 
! 	*/
! 	if ((type == 'g' && buflen <= (size_t)10 + (size_t)prec) ||
! 	    (type == 'f' && buflen <= (size_t)53 + (size_t)prec)) {
  		PyErr_SetString(PyExc_OverflowError,
  			"formatted float is too long (precision too large?)");
  		return -1;
  	}
+ 	PyOS_snprintf(fmt, sizeof(fmt), "%%%s.%d%c",
+ 		      (flags&F_ALT) ? "#" : "",
+ 		      prec, type);
  	PyOS_snprintf(buf, buflen, fmt, x);
  	return strlen(buf);

Index: unicodeobject.c
===================================================================
RCS file: /cvsroot/python/python/dist/src/Objects/unicodeobject.c,v
retrieving revision 2.124.6.18
retrieving revision 2.124.6.19
diff -C2 -d -r2.124.6.18 -r2.124.6.19
*** unicodeobject.c	7 Nov 2002 00:22:53 -0000	2.124.6.18
--- unicodeobject.c	2 Jan 2003 22:08:39 -0000	2.124.6.19
***************
*** 5251,5268 ****
      if (type == 'f' && (fabs(x) / 1e25) >= 1e25)
  	type = 'g';
!     PyOS_snprintf(fmt, sizeof(fmt), "%%%s.%d%c",
! 		  (flags & F_ALT) ? "#" : "", prec, type);
!     /* worst case length calc to ensure no buffer overrun:
!          fmt = %#.<prec>g
!          buf = '-' + [0-9]*prec + '.' + 'e+' + (longest exp
!             for any double rep.)
!          len = 1 + prec + 1 + 2 + 5 = 9 + prec
         If prec=0 the effective precision is 1 (the leading digit is
!        always given), therefore increase by one to 10+prec. */
!     if (buflen <= (size_t)10 + (size_t)prec) {
  	PyErr_SetString(PyExc_OverflowError,
! 	    "formatted float is too long (precision too long?)");
  	return -1;
      }
      return usprintf(buf, fmt, x);
  }
--- 5251,5279 ----
      if (type == 'f' && (fabs(x) / 1e25) >= 1e25)
  	type = 'g';
!     /* Worst case length calc to ensure no buffer overrun:
! 
!        'g' formats:
! 	 fmt = %#.<prec>g
! 	 buf = '-' + [0-9]*prec + '.' + 'e+' + (longest exp
! 	    for any double rep.)
! 	 len = 1 + prec + 1 + 2 + 5 = 9 + prec
! 
!        'f' formats:
! 	 buf = '-' + [0-9]*x + '.' + [0-9]*prec (with x < 50)
! 	 len = 1 + 50 + 1 + prec = 52 + prec
! 
         If prec=0 the effective precision is 1 (the leading digit is
!        always given), therefore increase the length by one. 
! 
!     */
!     if ((type == 'g' && buflen <= (size_t)10 + (size_t)prec) ||
! 	(type == 'f' && buflen <= (size_t)53 + (size_t)prec)) {
  	PyErr_SetString(PyExc_OverflowError,
! 			"formatted float is too long (precision too large?)");
  	return -1;
      }
+     PyOS_snprintf(fmt, sizeof(fmt), "%%%s.%d%c",
+ 		  (flags&F_ALT) ? "#" : "",
+ 		  prec, type);
      return usprintf(buf, fmt, x);
  }