mirrors/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2025-08-30 21:48:47 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 7

gh-106524: Fix a crash in _sre.template() (GH-106525)

Browse source 
Some items remained uninitialized if _sre.template() was called with invalid
indices. Then attempt to clear them in the destructor led to dereferencing
of uninitialized pointer.
This commit is contained in:
Radislav Chugunov 2023-07-08 10:47:01 +03:00 • committed by GitHub
parent 1c9e493462
commit 2ef1dc37f0
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 13 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

10
Lib/test/test_re.py
View file

@ -2418,6 +2418,16 @@ class ReTests(unittest.TestCase):
p.terminate()
p.join()
def test_sre_template_invalid_group_index(self):
# see gh-106524
import _sre
with self.assertRaises(TypeError) as cm:
_sre.template("", ["", -1, ""])
self.assertIn("invalid template", str(cm.exception))
with self.assertRaises(TypeError) as cm:
_sre.template("", ["", (), ""])
self.assertIn("an integer is required", str(cm.exception))
def get_debug_out(pat):
with captured_stdout() as out:

1
Misc/NEWS.d/next/Library/2023-07-07-17-44-03.gh-issue-106524.XkBV8h.rst Normal file
View file

@ -0,0 +1 @@
Fix crash in :func:`!_sre.template` with templates containing invalid group indices.

2
Modules/_sre/sre.c
View file

@ -1544,10 +1544,12 @@ _sre_template_impl(PyObject *module, PyObject *pattern, PyObject *template)
for (Py_ssize_t i = 0; i < n; i++) {
Py_ssize_t index = PyLong_AsSsize_t(PyList_GET_ITEM(template, 2*i+1));
if (index == -1 && PyErr_Occurred()) {
Py_SET_SIZE(self, i);
Py_DECREF(self);
return NULL;
}
if (index < 0) {
Py_SET_SIZE(self, i);
goto bad_template;
}
self->items[i].index = index;