diff options
| author | Radislav Chugunov <52372310+chgnrdv@users.noreply.github.com> | 2023-07-08 07:47:01 (GMT) |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2023-07-08 07:47:01 (GMT) |
| commit | 2ef1dc37f02b08536b677dd23ec51541a60effd7 (patch) | |
| tree | e86725b69ca4d321cb5ccc1397df5ca29a5195fc /Modules/_sre | |
| parent | 1c9e4934621627fbbfeada8d9dd87ecba4e446b0 (diff) | |
| download | cpython-2ef1dc37f02b08536b677dd23ec51541a60effd7.zip cpython-2ef1dc37f02b08536b677dd23ec51541a60effd7.tar.gz cpython-2ef1dc37f02b08536b677dd23ec51541a60effd7.tar.bz2 | |
gh-106524: Fix a crash in _sre.template() (GH-106525)
Some items remained uninitialized if _sre.template() was called with invalid
indices. Then attempt to clear them in the destructor led to dereferencing
of uninitialized pointer.
Diffstat (limited to 'Modules/_sre')
| -rw-r--r-- | Modules/_sre/sre.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/Modules/_sre/sre.c b/Modules/_sre/sre.c index 3f11916..98602b4 100644 --- a/Modules/_sre/sre.c +++ b/Modules/_sre/sre.c @@ -1544,10 +1544,12 @@ _sre_template_impl(PyObject *module, PyObject *pattern, PyObject *template) for (Py_ssize_t i = 0; i < n; i++) { Py_ssize_t index = PyLong_AsSsize_t(PyList_GET_ITEM(template, 2*i+1)); if (index == -1 && PyErr_Occurred()) { + Py_SET_SIZE(self, i); Py_DECREF(self); return NULL; } if (index < 0) { + Py_SET_SIZE(self, i); goto bad_template; } self->items[i].index = index; |