changeset:   106420:476b0fa34db4
parent:      106417:038dd5e1f01b
parent:      106419:393969776989
user:        Serhiy Storchaka <storchaka@gmail.com>
date:        Sat Feb 04 22:57:44 2017 +0200
files:       Lib/test/test_re.py Misc/NEWS Modules/_sre.c
description:
Issue #29444: Fixed out-of-bounds buffer access in the group() method of
the match object.  Based on patch by WGH.


diff -r 038dd5e1f01b -r 476b0fa34db4 Lib/test/test_re.py
--- a/Lib/test/test_re.py	Sat Feb 04 14:59:11 2017 +0100
+++ b/Lib/test/test_re.py	Sat Feb 04 22:57:44 2017 +0200
@@ -1821,6 +1821,16 @@
             warnings.simplefilter('error', BytesWarning)
             self.assertNotEqual(pattern3, pattern1)
 
+    def test_bug_29444(self):
+        s = bytearray(b'abcdefgh')
+        m = re.search(b'[a-h]+', s)
+        m2 = re.search(b'[e-h]+', s)
+        self.assertEqual(m.group(), b'abcdefgh')
+        self.assertEqual(m2.group(), b'efgh')
+        s[:] = b'xyz'
+        self.assertEqual(m.group(), b'xyz')
+        self.assertEqual(m2.group(), b'')
+
 
 class PatternReprTests(unittest.TestCase):
     def check(self, pattern, expected):
diff -r 038dd5e1f01b -r 476b0fa34db4 Misc/NEWS
--- a/Misc/NEWS	Sat Feb 04 14:59:11 2017 +0100
+++ b/Misc/NEWS	Sat Feb 04 22:57:44 2017 +0200
@@ -223,6 +223,9 @@
 Library
 -------
 
+- Issue #29444: Fixed out-of-bounds buffer access in the group() method of
+  the match object.  Based on patch by WGH.
+
 - Issue #29377: Add SlotWrapperType, MethodWrapperType, and
   MethodDescriptorType built-in types to types module.
   Original patch by Manuel Krebber.
diff -r 038dd5e1f01b -r 476b0fa34db4 Modules/_sre.c
--- a/Modules/_sre.c	Sat Feb 04 14:59:11 2017 +0100
+++ b/Modules/_sre.c	Sat Feb 04 22:57:44 2017 +0200
@@ -1945,6 +1945,7 @@
     Py_buffer view;
     PyObject *result;
     void* ptr;
+    Py_ssize_t i, j;
 
     if (index < 0 || index >= self->groups) {
         /* raise IndexError if we were given a bad group number */
@@ -1966,8 +1967,12 @@
     ptr = getstring(self->string, &length, &isbytes, &charsize, &view);
     if (ptr == NULL)
         return NULL;
-    result = getslice(isbytes, ptr,
-                      self->string, self->mark[index], self->mark[index+1]);
+
+    i = self->mark[index];
+    j = self->mark[index+1];
+    i = Py_MIN(i, length);
+    j = Py_MIN(j, length);
+    result = getslice(isbytes, ptr, self->string, i, j);
     if (isbytes && view.buf != NULL)
         PyBuffer_Release(&view);
     return result;