gh-140979: Fix off-by-one error in the RE code validator (GH-140984)

It was too lenient and allowed MARK opcodes with too large value.

diff --git a/Modules/_sre/sre.c b/Modules/_sre/sre.c
index fdf00e6499cb6bd365f5097840abc870ad1c409e..4e97101b699876fc9a209769a6d7a4499b3220e8 100644 (file)
--- a/Modules/_sre/sre.c
+++ b/Modules/_sre/sre.c
@@ -1946,7 +1946,7 @@ _validate_inner(SRE_CODE *code, SRE_CODE *end, Py_ssize_t groups)
                sre_match() code is robust even if they don't, and the worst
                you can get is nonsensical match results. */
             GET_ARG;
-            if (arg > 2 * (size_t)groups + 1) {
+            if (arg >= 2 * (size_t)groups) {
                 VTRACE(("arg=%d, groups=%d\n", (int)arg, (int)groups));
                 FAIL;
             }