Skip to content

Commit 308ac73

Browse files
committed
bpo-40958: Avoid buffer overflow in the parser when indexing the current line
1 parent 80d827c commit 308ac73

File tree

2 files changed

+8
-8
lines changed

2 files changed

+8
-8
lines changed
Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
Fix a possible buffer overflow in the PEG parser when gathering information
2+
for emitting syntax errors. Patch by Pablo Galindo.

Parser/pegen.c

Lines changed: 6 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -145,15 +145,12 @@ byte_offset_to_character_offset(PyObject *line, int col_offset)
145145
if (!str) {
146146
return 0;
147147
}
148+
assert(col_offset <= strlen(str));
148149
PyObject *text = PyUnicode_DecodeUTF8(str, col_offset, "replace");
149150
if (!text) {
150151
return 0;
151152
}
152153
Py_ssize_t size = PyUnicode_GET_LENGTH(text);
153-
str = PyUnicode_AsUTF8(text);
154-
if (str != NULL && (int)strlen(str) == col_offset) {
155-
size = strlen(str);
156-
}
157154
Py_DECREF(text);
158155
return size;
159156
}
@@ -400,16 +397,17 @@ _PyPegen_raise_error_known_location(Parser *p, PyObject *errtype,
400397

401398
if (!error_line) {
402399
Py_ssize_t size = p->tok->inp - p->tok->buf;
403-
if (size && p->tok->buf[size-1] == '\n') {
404-
size--;
405-
}
406400
error_line = PyUnicode_DecodeUTF8(p->tok->buf, size, "replace");
407401
if (!error_line) {
408402
goto error;
409403
}
410404
}
411405

412-
Py_ssize_t col_number = byte_offset_to_character_offset(error_line, col_offset);
406+
Py_ssize_t col_number = col_offset;
407+
408+
if (p->tok->encoding != NULL) {
409+
col_number = byte_offset_to_character_offset(error_line, col_offset);
410+
}
413411

414412
tmp = Py_BuildValue("(OiiN)", p->tok->filename, lineno, col_number, error_line);
415413
if (!tmp) {

0 commit comments

Comments
 (0)