[3.13] gh-140979: Fix off-by-one error in the RE code validator (GH-140984) (GH-141000)

miss-islington · serhiy-storchaka · web-flow · commit fd9be78f4e43 · 2025-11-04T18:16:40.000+02:00
It was too lenient and allowed MARK opcodes with too large value. (cherry picked from commit 1326d2a) Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
diff --git a/Modules/_sre/sre.c b/Modules/_sre/sre.c
@@ -1932,7 +1932,7 @@ _validate_inner(SRE_CODE *code, SRE_CODE *end, Py_ssize_t groups)
                sre_match() code is robust even if they don't, and the worst
                you can get is nonsensical match results. */
             GET_ARG;
-            if (arg > 2 * (size_t)groups + 1) {
+            if (arg >= 2 * (size_t)groups) {
                 VTRACE(("arg=%d, groups=%d\n", (int)arg, (int)groups));
                 FAIL;
             }

Original file line number	Diff line number	Diff line change
`@@ -1932,7 +1932,7 @@ _validate_inner(SRE_CODE code, SRE_CODE end, Py_ssize_t groups)`
`1932`	`1932`	`sre_match() code is robust even if they don't, and the worst`
`1933`	`1933`	`you can get is nonsensical match results. */`
`1934`	`1934`	`GET_ARG;`
`1935`		`- if (arg > 2 * (size_t)groups + 1) {`
	`1935`	`+ if (arg >= 2 * (size_t)groups) {`
`1936`	`1936`	`VTRACE(("arg=%d, groups=%d\n", (int)arg, (int)groups));`
`1937`	`1937`	`FAIL;`
`1938`	`1938`	`}`