Fixed sre bug "[#581080] Provoking infinite scanner loops".

This bug happened because: 1) the scanner_search and scanner_match methods
were not checking the buffer limits before increasing the current pointer;
and 2) SRE_SEARCH was using "if (ptr == end)" as a loop break, instead of
"if (ptr >= end)".

* Modules/_sre.c
  (SRE_SEARCH): Check for "ptr >= end" to break loops, so that we don't
  hang forever if a pointer passing the buffer limit is used.
  (scanner_search,scanner_match): Don't increment the current pointer
  if we're going to pass the buffer limit.

* Misc/NEWS
  Mention the fix.

1 files changed, 5 insertions, 0 deletions

diff --git a/Misc/NEWS b/Misc/NEWS
index 5d97dd7..8b1d085 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -359,6 +359,11 @@ Extension modules
   when running the expression r'(a)(b)?b' over 'ab', lastindex must be
   1, not 2.
 
+- Fixed bug #581080: sre scanner was not checking the buffer limit
+  before increasing the current pointer. This was creating an infinite
+  loop in the search function, once the pointer exceeded the buffer
+  limit.
+
 Library
 -------