From 47941b9192455877a7a96461a990d66809e6f444 Mon Sep 17 00:00:00 2001 From: Dmitry Mihalchenko Date: Wed, 28 Oct 2026 13:49:05 +0300 Subject: [PATCH 1/3] gh-160814: Reject IN opcode with skip < 2 in the SRE validator --- Modules/_sre/sre.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/Modules/_sre/sre.c b/Modules/_sre/sre.c index 47c2c4abc3ef24..1c810a419b7a29 100644 --- a/Modules/_sre/sre.c +++ b/Modules/_sre/sre.c @@ -2212,6 +2212,8 @@ _validate_inner(SRE_CODE *code, SRE_CODE *end, Py_ssize_t groups) case SRE_OP_IN_UNI_IGNORE: case SRE_OP_IN_LOC_IGNORE: GET_SKIP; + if (skip < 2) + FAIL; /* Stop 1 before the end; we check the FAILURE below */ if (_validate_charset(code, code+skip-2)) FAIL; From 46264c176a439be7d8b8ef0fd88cc5afac2b9e14 Mon Sep 17 00:00:00 2001 From: Dmitry Mihalchenko Date: Wed, 28 Oct 2026 13:49:47 +0300 Subject: [PATCH 2/3] gh-160814: Add NEWS entry --- .../next/Library/2026-10-28-13-49-42.gh-issue-160814.DwqVVi.rst | 2 ++ 1 file changed, 2 insertions(+) create mode 100644 Misc/NEWS.d/next/Library/2026-10-28-13-49-42.gh-issue-160814.DwqVVi.rst diff --git a/Misc/NEWS.d/next/Library/2026-10-28-13-49-42.gh-issue-160814.DwqVVi.rst b/Misc/NEWS.d/next/Library/2026-10-28-13-49-42.gh-issue-160814.DwqVVi.rst new file mode 100644 index 00000000000000..df50ecd73c0931 --- /dev/null +++ b/Misc/NEWS.d/next/Library/2026-10-28-13-49-42.gh-issue-160814.DwqVVi.rst @@ -0,0 +1,2 @@ +Fix crash in :meth:`!_sre.compile` with an ``IN`` opcode whose ``skip`` value +is smaller than 2. From 41f8010416f48e959d013299d0eb1e728930119e Mon Sep 17 00:00:00 2001 From: Dmitry Mihalchenko Date: Thu, 29 Oct 2026 09:31:50 +0300 Subject: [PATCH 3/3] gh-160814: Add test for IN with skip < 2 in the SRE validator --- Lib/test/test_re.py | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/Lib/test/test_re.py b/Lib/test/test_re.py index 8e7611344b9150..5d5538c373fec8 100644 --- a/Lib/test/test_re.py +++ b/Lib/test/test_re.py @@ -3263,6 +3263,14 @@ def test_sre_template_invalid_group_index(self): _sre.template("", ["", (), ""]) self.assertIn("an integer is required", str(cm.exception)) + @cpython_only + def test_sre_IN_invalid_skip(self): + # gh-160814: the validator must reject the IN opcode with skip < 2. + import _sre + for skip in (0, 1): + with self.assertRaises(RuntimeError): + _sre.compile("x", 0, [13, skip, 1], 0, {}, ()) + class ExternalTests(unittest.TestCase):