[New-bugs-announce] [issue15516] exception-handling bug in PyString_Format

[Tom Tromey]

New submission from Tom Tromey:

In gdb we supply a class whose nb_int method can throw
an exception.

A user wrote code like this:

    return '%x' % value

... where "value" was an instance of this class.
This caused funny exception behavior later on.
You can see the original report here:

http://sourceware.org/bugzilla/show_bug.cgi?id=14320

I tracked down the odd behavior to this code in
stringobject.c:PyString_Format:

                        iobj = PyNumber_Int(v);
                        if (iobj==NULL) iobj = PyNumber_Long(v);

Here, PyNumber_Int fails and sets the exception.
I think this ought to be cleared before calling
PyNumber_Long.  In our case, PyNumber_Long succeeds,
and the program keeps executing until something happens
to call PyErr_Occurred.

I think this patch ought to fix the problem:

diff -r e0eb7dea245f Objects/stringobject.c
--- a/Objects/stringobject.c	Mon Jul 30 04:07:49 2012 -0700
+++ b/Objects/stringobject.c	Tue Jul 31 13:58:07 2012 -0600
@@ -4489,7 +4489,10 @@
                     }
                     else {
                         iobj = PyNumber_Int(v);
-                        if (iobj==NULL) iobj = PyNumber_Long(v);
+                        if (iobj==NULL) {
+			    PyErr_Clear();
+			    iobj = PyNumber_Long(v);
+			}
                     }
                     if (iobj!=NULL) {
                         if (PyInt_Check(iobj)) {

I haven't written a test case yet; David Malcolm suggested I file
a bug here first.

----------
components: None
messages: 167043
nosy: tromey
priority: normal
severity: normal
status: open
title: exception-handling bug in PyString_Format
type: behavior
versions: Python 2.7

_______________________________________
Python tracker <report at bugs.python.org>
<http://bugs.python.org/issue15516>
_______________________________________