diff options
| -rw-r--r-- | Misc/NEWS | 5 | ||||
| -rw-r--r-- | Modules/_sre.c | 10 |
2 files changed, 11 insertions, 4 deletions
@@ -359,6 +359,11 @@ Extension modules when running the expression r'(a)(b)?b' over 'ab', lastindex must be 1, not 2. +- Fixed bug #581080: sre scanner was not checking the buffer limit + before increasing the current pointer. This was creating an infinite + loop in the search function, once the pointer exceeded the buffer + limit. + Library ------- diff --git a/Modules/_sre.c b/Modules/_sre.c index 4440a6e..0357764 100644 --- a/Modules/_sre.c +++ b/Modules/_sre.c @@ -1237,7 +1237,7 @@ SRE_SEARCH(SRE_STATE* state, SRE_CODE* pattern) for (;;) { while (ptr < end && (SRE_CODE) ptr[0] != chr) ptr++; - if (ptr == end) + if (ptr >= end) return 0; TRACE(("|%p|%p|SEARCH LITERAL\n", pattern, ptr)); state->start = ptr; @@ -1254,7 +1254,7 @@ SRE_SEARCH(SRE_STATE* state, SRE_CODE* pattern) for (;;) { while (ptr < end && !SRE_CHARSET(charset, ptr[0])) ptr++; - if (ptr == end) + if (ptr >= end) return 0; TRACE(("|%p|%p|SEARCH CHARSET\n", pattern, ptr)); state->start = ptr; @@ -2896,7 +2896,8 @@ scanner_match(ScannerObject* self, PyObject* args) match = pattern_new_match((PatternObject*) self->pattern, state, status); - if (status == 0 || state->ptr == state->start) + if ((status == 0 || state->ptr == state->start) && + state->ptr < state->end) state->start = (void*) ((char*) state->ptr + state->charsize); else state->start = state->ptr; @@ -2927,7 +2928,8 @@ scanner_search(ScannerObject* self, PyObject* args) match = pattern_new_match((PatternObject*) self->pattern, state, status); - if (status == 0 || state->ptr == state->start) + if ((status == 0 || state->ptr == state->start) && + state->ptr < state->end) state->start = (void*) ((char*) state->ptr + state->charsize); else state->start = state->ptr; |