mirrors/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2025-08-03 16:39:00 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 8

Issue #18684: Fixed reading out of the buffer in the re module.

Browse source
This commit is contained in:
Serhiy Storchaka 2015-07-06 14:03:01 +03:00
commit 02eae6b1f2
3 changed files with 43 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

29
Modules/sre_lib.h
View file

@ -30,7 +30,7 @@ SRE(at)(SRE_STATE* state, SRE_CHAR* ptr, SRE_CODE at)
SRE_IS_LINEBREAK((int) ptr[-1]));
case SRE_AT_END:
return (((void*) (ptr+1) == state->end &&
return (((SRE_CHAR *)state->end - ptr == 1 &&
SRE_IS_LINEBREAK((int) ptr[0])) ||
((void*) ptr == state->end));
@ -1109,9 +1109,9 @@ entrance:
/* <ASSERT> <skip> <back> <pattern> */
TRACE(("|%p|%p|ASSERT %d\n", ctx->pattern,
ctx->ptr, ctx->pattern[1]));
state->ptr = ctx->ptr - ctx->pattern[1];
if (state->ptr < state->beginning)
if (ctx->ptr - (SRE_CHAR *)state->beginning < (Py_ssize_t)ctx->pattern[1])
RETURN_FAILURE;
state->ptr = ctx->ptr - ctx->pattern[1];
DO_JUMP0(JUMP_ASSERT, jump_assert, ctx->pattern+2);
RETURN_ON_FAILURE(ret);
ctx->pattern += ctx->pattern[0];
@ -1122,8 +1122,8 @@ entrance:
/* <ASSERT_NOT> <skip> <back> <pattern> */
TRACE(("|%p|%p|ASSERT_NOT %d\n", ctx->pattern,
ctx->ptr, ctx->pattern[1]));
state->ptr = ctx->ptr - ctx->pattern[1];
if (state->ptr >= state->beginning) {
if (ctx->ptr - (SRE_CHAR *)state->beginning >= (Py_ssize_t)ctx->pattern[1]) {
state->ptr = ctx->ptr - ctx->pattern[1];
DO_JUMP0(JUMP_ASSERT_NOT, jump_assert_not, ctx->pattern+2);
if (ret) {
RETURN_ON_ERROR(ret);
@ -1215,12 +1215,20 @@ SRE(search)(SRE_STATE* state, SRE_CODE* pattern)
SRE_CODE* overlap = NULL;
int flags = 0;
if (ptr > end)
return 0;
if (pattern[0] == SRE_OP_INFO) {
/* optimization info block */
/* <INFO> <1=skip> <2=flags> <3=min> <4=max> <5=prefix info> */
flags = pattern[2];
if (pattern[3] && end - ptr < (Py_ssize_t)pattern[3]) {
TRACE(("reject (got %u chars, need %u)\n",
(unsigned int)(end - ptr), pattern[3]));
return 0;
}
if (pattern[3] > 1) {
/* adjust end point (but make sure we leave at least one
character in there, so literal search will work) */
@ -1338,15 +1346,18 @@ SRE(search)(SRE_STATE* state, SRE_CODE* pattern)
break;
ptr++;
}
} else
} else {
/* general case */
while (ptr <= end) {
assert(ptr <= end);
while (1) {
TRACE(("|%p|%p|SEARCH\n", pattern, ptr));
state->start = state->ptr = ptr++;
state->start = state->ptr = ptr;
status = SRE(match)(state, pattern, 0);
if (status != 0)
if (status != 0 || ptr >= end)
break;
ptr++;
}
}
return status;
}