Finish!

sobolevn · sobolevn · commit 9bc086438d2a · 2023-02-09T13:49:00.000+03:00
diff --git a/Modules/_ctypes/_ctypes.c b/Modules/_ctypes/_ctypes.c
@@ -2639,7 +2639,8 @@ unique_key(CDataObject *target, Py_ssize_t index)
     size_t bytes_left;
 
     Py_BUILD_ASSERT(sizeof(string) - 1 > sizeof(Py_ssize_t) * 2);
-    cp += sprintf(cp, "%x", Py_SAFE_DOWNCAST(index, Py_ssize_t, int));
+    cp += PyOS_snprintf(cp, sizeof(Py_ssize_t), "%x",
+                        Py_SAFE_DOWNCAST(index, Py_ssize_t, int));
     while (target->b_base) {
         bytes_left = sizeof(string) - (cp - string) - 1;
         /* Hex format needs 2 characters per byte */
@@ -2648,7 +2649,8 @@ unique_key(CDataObject *target, Py_ssize_t index)
                             "ctypes object structure too deep");
             return NULL;
         }
-        cp += sprintf(cp, ":%x", Py_SAFE_DOWNCAST(target->b_index, Py_ssize_t, int));
+        cp += PyOS_snprintf(cp, bytes_left, ":%x",
+                            Py_SAFE_DOWNCAST(target->b_index, Py_ssize_t, int));
         target = target->b_base;
     }
     return PyUnicode_FromStringAndSize(string, cp-string);
diff --git a/Objects/unicodeobject.c b/Objects/unicodeobject.c
@@ -733,7 +733,8 @@ xmlcharrefreplace(_PyBytesWriter *writer, char *str,
 
     /* generate replacement */
     for (i = collstart; i < collend; ++i) {
-        size = sprintf(str, "&#%d;", PyUnicode_READ(kind, data, i));
+        size = PyOS_snprintf(str, 10, "&#%d;",
+                             PyUnicode_READ(kind, data, i));
         if (size < 0) {
             return NULL;
         }
diff --git a/Parser/string_parser.c b/Parser/string_parser.c
@@ -118,7 +118,7 @@ decode_unicode_with_escapes(Parser *parser, const char *s, size_t len, Token *t)
             w_len = PyUnicode_GET_LENGTH(w);
             for (i = 0; i < w_len; i++) {
                 Py_UCS4 chr = PyUnicode_READ(kind, data, i);
-                sprintf(p, "\\U%08x", chr);
+                PyOS_snprintf(p, 10, "\\U%08x", chr);
                 p += 10;
             }
             /* Should be impossible to overflow */
diff --git a/Python/pystrtod.c b/Python/pystrtod.c
@@ -1239,7 +1239,7 @@ format_float_short(double d, char format_code,
     /* Now that we've done zero padding, add an exponent if needed. */
     if (use_exp) {
         *p++ = float_strings[OFS_E][0];
-        exp_len = sprintf(p, "%+.02d", exp);
+        exp_len = PyOS_snprintf(p, 5, "%+.02d", exp); // see `bufsize` comments
         p += exp_len;
     }
   exit:

Original file line number	Diff line number	Diff line change
`@@ -733,7 +733,8 @@ xmlcharrefreplace(_PyBytesWriter writer, char str,`
`733`	`733`
`734`	`734`	`/* generate replacement */`
`735`	`735`	`for (i = collstart; i < collend; ++i) {`
`736`		`- size = sprintf(str, "&#%d;", PyUnicode_READ(kind, data, i));`
	`736`	`+ size = PyOS_snprintf(str, 10, "&#%d;",`
	`737`	`+ PyUnicode_READ(kind, data, i));`
`737`	`738`	`if (size < 0) {`
`738`	`739`	`return NULL;`
`739`	`740`	`}`
Original file line number	Diff line number	Diff line change
`@@ -118,7 +118,7 @@ decode_unicode_with_escapes(Parser parser, const char s, size_t len, Token *t)`
`118`	`118`	`w_len = PyUnicode_GET_LENGTH(w);`
`119`	`119`	`for (i = 0; i < w_len; i++) {`
`120`	`120`	`Py_UCS4 chr = PyUnicode_READ(kind, data, i);`
`121`		`- sprintf(p, "\\U%08x", chr);`
	`121`	`+ PyOS_snprintf(p, 10, "\\U%08x", chr);`
`122`	`122`	`p += 10;`
`123`	`123`	`}`
`124`	`124`	`/* Should be impossible to overflow */`
Original file line number	Diff line number	Diff line change
`@@ -1239,7 +1239,7 @@ format_float_short(double d, char format_code,`
`1239`	`1239`	`/* Now that we've done zero padding, add an exponent if needed. */`
`1240`	`1240`	`if (use_exp) {`
`1241`	`1241`	`*p++ = float_strings[OFS_E][0];`
`1242`		`- exp_len = sprintf(p, "%+.02d", exp);`
	`1242`	+ exp_len = PyOS_snprintf(p, 5, "%+.02d", exp); // see `bufsize` comments
`1243`	`1243`	`p += exp_len;`
`1244`	`1244`	`}`
`1245`	`1245`	`exit:`