[DmitryTD]

The IN opcode branch of _validate_inner() reads code[skip-2] without checking that skip >= 2. skip is unsigned, so for skip of 0 or 1 the index skip - 2 wraps to a huge value and the read goes out of bounds, crashing the interpreter.

This is reachable only by passing hand-crafted bytecode to _sre.compile(); the public re compiler always emits skip >= 2 for IN.

• Issue: _sre: out-of-bounds read in the SRE code validator for IN opcode with skip < 2 #160814

[python-cla-bot]

All commit authors signed the Contributor License Agreement.

[sobolevn]

_sre.compile("x", 0, [13, 0, 1], 0, {}, ()) as a reproducer seems simple enough to test: it must not crash.

[DmitryTD]

Added a test