From 402c0caa851e265410fbcaa55318f22d2bf22ee2 Mon Sep 17 00:00:00 2001 From: Carlton Gibson Date: Mon, 11 Feb 2019 11:08:45 +0100 Subject: Fixed CVE-2019-6975 -- Fixed memory exhaustion in utils.numberformat.format(). Thanks Sjoerd Job Postmus for the report and initial patch. Thanks Michael Manfre, Tim Graham, and Florian Apolloner for review. --- django/utils/numberformat.py | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) (limited to 'django/utils') diff --git a/django/utils/numberformat.py b/django/utils/numberformat.py index 9c0496342d..88b35fc435 100644 --- a/django/utils/numberformat.py +++ b/django/utils/numberformat.py @@ -27,7 +27,20 @@ def format(number, decimal_sep, decimal_pos=None, grouping=0, thousand_sep='', # sign sign = '' if isinstance(number, Decimal): - str_number = '{:f}'.format(number) + # Format values with more than 200 digits (an arbitrary cutoff) using + # scientific notation to avoid high memory usage in {:f}'.format(). + _, digits, exponent = number.as_tuple() + if abs(exponent) + len(digits) > 200: + number = '{:e}'.format(number) + coefficient, exponent = number.split('e') + # Format the coefficient. + coefficient = format( + coefficient, decimal_sep, decimal_pos, grouping, + thousand_sep, force_grouping, use_l10n, + ) + return '{}e{}'.format(coefficient, exponent) + else: + str_number = '{:f}'.format(number) else: str_number = str(number) if str_number[0] == '-': -- cgit v1.3