diff options
| author | Serhiy Storchaka <storchaka@gmail.com> | 2013-02-16 19:23:01 (GMT) |
|---|---|---|
| committer | Serhiy Storchaka <storchaka@gmail.com> | 2013-02-16 19:23:01 (GMT) |
| commit | 6a8e2b49822b396870bc7afd2274ba50af931a65 (patch) | |
| tree | d24ec1b96236cd003d7d48bcf7afafde852919e9 | |
| parent | e18e05cce92182e7f852e2d1569904190b8a9a40 (diff) | |
| download | cpython-6a8e2b49822b396870bc7afd2274ba50af931a65.zip cpython-6a8e2b49822b396870bc7afd2274ba50af931a65.tar.gz cpython-6a8e2b49822b396870bc7afd2274ba50af931a65.tar.bz2 | |
Issue #9669: Protect re against infinite loops on zero-width matching in
non-greedy repeat. Patch by Matthew Barnett.
| -rw-r--r-- | Lib/test/test_re.py | 9 | ||||
| -rw-r--r-- | Misc/NEWS | 3 | ||||
| -rw-r--r-- | Modules/_sre.c | 9 |
3 files changed, 19 insertions, 2 deletions
diff --git a/Lib/test/test_re.py b/Lib/test/test_re.py index a9d6f2c..6ddddda 100644 --- a/Lib/test/test_re.py +++ b/Lib/test/test_re.py @@ -628,6 +628,15 @@ class ReTests(unittest.TestCase): self.assertEqual(re.match('(x)*y', 50000*'x'+'y').group(1), 'x') self.assertEqual(re.match('(x)*?y', 50000*'x'+'y').group(1), 'x') + def test_unlimited_zero_width_repeat(self): + # Issue #9669 + self.assertIsNone(re.match(r'(?:a?)*y', 'z')) + self.assertIsNone(re.match(r'(?:a?)+y', 'z')) + self.assertIsNone(re.match(r'(?:a?){2,}y', 'z')) + self.assertIsNone(re.match(r'(?:a?)*?y', 'z')) + self.assertIsNone(re.match(r'(?:a?)+?y', 'z')) + self.assertIsNone(re.match(r'(?:a?){2,}?y', 'z')) + def test_scanner(self): def s_ident(scanner, token): return token def s_operator(scanner, token): return "op%s" % token @@ -205,6 +205,9 @@ Core and Builtins Library ------- +- Issue #9669: Protect re against infinite loops on zero-width matching in + non-greedy repeat. Patch by Matthew Barnett. + - Issue #13169: The maximal repetition number in a regular expression has been increased from 65534 to 2147483647 (on 32-bit platform) or 4294967294 (on 64-bit). diff --git a/Modules/_sre.c b/Modules/_sre.c index 73e5aac..f3a2993 100644 --- a/Modules/_sre.c +++ b/Modules/_sre.c @@ -1302,13 +1302,18 @@ entrance: LASTMARK_RESTORE(); - if (ctx->count >= ctx->u.rep->pattern[2] - && ctx->u.rep->pattern[2] != SRE_MAXREPEAT) + if ((ctx->count >= ctx->u.rep->pattern[2] + && ctx->u.rep->pattern[2] != SRE_MAXREPEAT) || + state->ptr == ctx->u.rep->last_ptr) RETURN_FAILURE; ctx->u.rep->count = ctx->count; + /* zero-width match protection */ + DATA_PUSH(&ctx->u.rep->last_ptr); + ctx->u.rep->last_ptr = state->ptr; DO_JUMP(JUMP_MIN_UNTIL_3,jump_min_until_3, ctx->u.rep->pattern+3); + DATA_POP(&ctx->u.rep->last_ptr); if (ret) { RETURN_ON_ERROR(ret); RETURN_SUCCESS; |