diff options
| author | Serhiy Storchaka <storchaka@gmail.com> | 2013-02-16 19:25:05 (GMT) |
|---|---|---|
| committer | Serhiy Storchaka <storchaka@gmail.com> | 2013-02-16 19:25:05 (GMT) |
| commit | b0c75a7dec2ae9d514ac8df63a4822215e486e1f (patch) | |
| tree | 3a95c5e15ada6a2fa4613dcb6a6d2336723c25ba /Modules | |
| parent | f8def28ff03f3167bd0becabab4dc5d70ee22033 (diff) | |
| parent | fa4681691591429466d18e21d7640e3703ab7f28 (diff) | |
| download | cpython-b0c75a7dec2ae9d514ac8df63a4822215e486e1f.zip cpython-b0c75a7dec2ae9d514ac8df63a4822215e486e1f.tar.gz cpython-b0c75a7dec2ae9d514ac8df63a4822215e486e1f.tar.bz2 | |
Issue #9669: Protect re against infinite loops on zero-width matching in
non-greedy repeat. Patch by Matthew Barnett.
Diffstat (limited to 'Modules')
| -rw-r--r-- | Modules/_sre.c | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/Modules/_sre.c b/Modules/_sre.c index c3c983d..7e447a9 100644 --- a/Modules/_sre.c +++ b/Modules/_sre.c @@ -1272,13 +1272,18 @@ entrance: LASTMARK_RESTORE(); - if (ctx->count >= ctx->u.rep->pattern[2] - && ctx->u.rep->pattern[2] != SRE_MAXREPEAT) + if ((ctx->count >= ctx->u.rep->pattern[2] + && ctx->u.rep->pattern[2] != SRE_MAXREPEAT) || + state->ptr == ctx->u.rep->last_ptr) RETURN_FAILURE; ctx->u.rep->count = ctx->count; + /* zero-width match protection */ + DATA_PUSH(&ctx->u.rep->last_ptr); + ctx->u.rep->last_ptr = state->ptr; DO_JUMP(JUMP_MIN_UNTIL_3,jump_min_until_3, ctx->u.rep->pattern+3); + DATA_POP(&ctx->u.rep->last_ptr); if (ret) { RETURN_ON_ERROR(ret); RETURN_SUCCESS; |