Skip to content

Use PyErr_Format instead of sprintf - #9863

Open
akx wants to merge 2 commits into
python-pillow:mainfrom
akx:pyerr
Open

Use PyErr_Format instead of sprintf#9863
akx wants to merge 2 commits into
python-pillow:mainfrom
akx:pyerr

Conversation

@akx

@akx akx commented Aug 11, 2026

Copy link
Copy Markdown
Contributor

Just noticed a couple places using sprintf() instead of PyErr_Format, figured those could use unifying.

@akx
akx marked this pull request as ready for review August 11, 2026 09:58
@radarhere

Copy link
Copy Markdown
Member

While I don't see a problem, it's worth being aware that this is rewriting the fix to GHSA-7534-mm45-c74v

@akx

akx commented Aug 12, 2026

Copy link
Copy Markdown
Contributor Author

@radarhere Thanks! Good note. I looked into it: PyErr_Format calls _PyErr_FormatV, which calls PyUnicode_FromFormatV, which uses PyUnicodeWriter (an automatically growing buffer) with unicode_from_format, so buffer overflows shouldn't be possible with PyErr_Format.

I reverted the (inadvertent, my bad!) template string changes back to %.10s though, so no chance of MemoryError either.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants