mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-10-31 09:41:08 +00:00
Code Issues 32 Releases Wiki Activity

[2.2.x] Fixed CVE-2019-6975 -- Fixed memory exhaustion in utils.numberformat.format().

Browse Source 
Thanks Sjoerd Job Postmus for the report and initial patch.
Thanks Michael Manfre, Tim Graham, and Florian Apolloner for review.

Backport of 402c0caa85 from master
This commit is contained in:
Carlton Gibson
2019-02-11 11:08:45 +01:00
parent b89d31d2dc
commit 83ab3e2664
5 changed files with 69 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
django/utils/numberformat.py
View File

@@ -27,7 +27,20 @@ def format(number, decimal_sep, decimal_pos=None, grouping=0, thousand_sep='',
# sign
sign = ''
if isinstance(number, Decimal):
str_number = '{:f}'.format(number)
# Format values with more than 200 digits (an arbitrary cutoff) using
# scientific notation to avoid high memory usage in {:f}'.format().
_, digits, exponent = number.as_tuple()
if abs(exponent) + len(digits) > 200:
number = '{:e}'.format(number)
coefficient, exponent = number.split('e')
# Format the coefficient.
coefficient = format(
coefficient, decimal_sep, decimal_pos, grouping,
thousand_sep, force_grouping, use_l10n,
)
return '{}e{}'.format(coefficient, exponent)
else:
str_number = '{:f}'.format(number)
else:
str_number = str(number)
if str_number[0] == '-':