Skip to content

gh-160814: Fix out-of-bounds read in the SRE code validator for IN with skip < 2 #160815

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
DmitryTD wants to merge 3 commits into
base: main
Choose a base branch
from
Open

gh-160814: Fix out-of-bounds read in the SRE code validator for IN with skip < 2 #160815

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
47941b9
gh-160814: Reject IN opcode with skip < 2 in the SRE validator
DmitryTD Oct 28, 2026
46264c1
gh-160814: Add NEWS entry
DmitryTD Oct 28, 2026
41f8010
gh-160814: Add test for IN with skip < 2 in the SRE validator
DmitryTD Oct 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions Lib/test/test_re.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3263,6 +3263,14 @@ def test_sre_template_invalid_group_index(self):
_sre.template("", ["", (), ""])
self.assertIn("an integer is required", str(cm.exception))

@cpython_only
def test_sre_IN_invalid_skip(self):
# gh-160814: the validator must reject the IN opcode with skip < 2.
import _sre
for skip in (0, 1):
with self.assertRaises(RuntimeError):
_sre.compile("x", 0, [13, skip, 1], 0, {}, ())


class ExternalTests(unittest.TestCase):

Expand Down
2 changes: 2 additions & 0 deletions Misc/NEWS.d/next/Library/2026-10-28-13-49-42.gh-issue-160814.DwqVVi.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
Fix crash in :meth:`!_sre.compile` with an ``IN`` opcode whose ``skip`` value
is smaller than 2.
2 changes: 2 additions & 0 deletions Modules/_sre/sre.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2212,6 +2212,8 @@ _validate_inner(SRE_CODE *code, SRE_CODE *end, Py_ssize_t groups)
case SRE_OP_IN_UNI_IGNORE:
case SRE_OP_IN_LOC_IGNORE:
GET_SKIP;
if (skip < 2)
FAIL;
/* Stop 1 before the end; we check the FAILURE below */
if (_validate_charset(code, code+skip-2))
FAIL;
Expand Down
Loading