http://hg.python.org/cpython/file/2.7/Objects/unicodeobject.c#l840

Specifically it calls "PyObject_Str", which will return a PyStringObject * (cast to a PyObject *), and then calls "PyUnicode_GET_SIZE", which is of course totally incorrect.

This code was originally back-ported from 3.0 -> 2.6, so I imagine no one caught the bug then.

It's worth noting that this function is replete with incorrect assumptions about unicode vs. strings that came from the backport, the one I initially pointed out was merely the first.

The motivation for this issue is the SSL module backport (issue21308) for the record :-)

Python 3 has many unit tests for PyUnicode_FromFormat(): see test_unicode.test_from_format().

Here is a patch fixing %S and %R formats and supporting %li and %zi. It fixes also %S, %R and %V for non-ASCII characters.

PyUnicode_FromFormat() of Python 2 doesn't support width, precision and padding. For example, "%100i" does crash. For %S, %R and %V, the function decodes byte strings from ISO-8859-1 in Python 2, whereas it decodes from UTF-8 in Python 3.

Hi Victor, thanks for working on this. I don't know the Unicode codebase that well, but this looks like an obvious improvement to me (much less broken :-)).

Reviewed more closely today, I think the docs probably need updating, but otherwise this LGTM, massive improvement! Thanks!

I've tested in my local dev with my SSL patches applied, and I've confirmed that it fixes the segfaults.

New changeset 263701e0b77e by Victor Stinner in branch '2.7':
Issue #22023: Fix %S, %R and %V formats of PyUnicode_FromFormat().
http://hg.python.org/cpython/rev/263701e0b77e

Oh, supporting %li and %zi is a new feature, it's too late to add this in Python 2.7. I removed this part of my patch. I commited the other part.

PyUnicode_FromFormat() decodes byte strings from ISO 8859-1 for %S, %R and %V formats. I don't like this choice, we should use the default encoding or UTF-8. But it's also probably too late to change that. At least, b'\xff' is decoded to '\xe4' instead of '\xffe4' (signed/unsigned integer issue, also fixed by my patch). It's a little bit better than before.