gh-91700: Validate the group number in conditional expression in RE (GH-91702)

In expression (?(group)...) an appropriate re.error is now
raised if the group number refers to not defined group.

Previously it raised RuntimeError: invalid SRE code.

1 files changed, 10 insertions, 0 deletions

diff --git a/Lib/re/_parser.py b/Lib/re/_parser.py
index 6588862..60ec3e8 100644
--- a/Lib/re/_parser.py
+++ b/Lib/re/_parser.py
@@ -77,6 +77,7 @@ class State:
         self.groupdict = {}
         self.groupwidths = [None]  # group 0
         self.lookbehindgroups = None
+        self.grouprefpos = {}
     @property
     def groups(self):
         return len(self.groupwidths)
@@ -795,6 +796,10 @@ def _parse(source, state, verbose, nested, first=False):
                         if condgroup >= MAXGROUPS:
                             msg = "invalid group reference %d" % condgroup
                             raise source.error(msg, len(condname) + 1)
+                        if condgroup not in state.grouprefpos:
+                            state.grouprefpos[condgroup] = (
+                                source.tell() - len(condname) - 1
+                            )
                     state.checklookbehindgroup(condgroup, source)
                     item_yes = _parse(source, state, verbose, nested + 1)
                     if source.match("|"):
@@ -975,6 +980,11 @@ def parse(str, flags=0, state=None):
         assert source.next == ")"
         raise source.error("unbalanced parenthesis")
 
+    for g in p.state.grouprefpos:
+        if g >= p.state.groups:
+            msg = "invalid group reference %d" % g
+            raise error(msg, str, p.state.grouprefpos[g])
+
     if flags & SRE_FLAG_DEBUG:
         p.dump()