diff options
| author | Jamie Davis <davisjam@vt.edu> | 2018-03-06 05:59:02 (GMT) |
|---|---|---|
| committer | Benjamin Peterson <benjamin@python.org> | 2018-03-06 05:59:02 (GMT) |
| commit | 55d5bfba9482d39080f7b9ec3e6257ecd23f264f (patch) | |
| tree | fe770dee608b13e72312faab4e96780891a77fb3 /Python/ceval.c | |
| parent | e052d40cea15f582b50947f7d906b39744dc62a2 (diff) | |
| download | cpython-55d5bfba9482d39080f7b9ec3e6257ecd23f264f.zip cpython-55d5bfba9482d39080f7b9ec3e6257ecd23f264f.tar.gz cpython-55d5bfba9482d39080f7b9ec3e6257ecd23f264f.tar.bz2 | |
[2.7] closes bpo-32997: Fix REDOS in fpformat (GH-5984)
The regex to decode a number in fpformat is susceptible to catastrophic backtracking. This is a potential DOS vector if a server is using fpformat on untrusted number strings.
Replace it with an equivalent non-vulnerable regex. The match behavior of the new regex is slightly different. It captures the whole integer part of the number in one group, Leading zeros are stripped off later.
Diffstat (limited to 'Python/ceval.c')
0 files changed, 0 insertions, 0 deletions