gh-106524: Fix a crash in _sre.template() (GH-106525)

Some items remained uninitialized if _sre.template() was called with invalid
indices. Then attempt to clear them in the destructor led to dereferencing
of uninitialized pointer.

diff --git a/Lib/test/test_re.py b/Lib/test/test_re.py
index e4d14356402db78d523a9e1d989a34c1a5d9626c..8f26d0aacf4eee1cc24bb9223544c572ef56bfca 100644 (file)
--- a/Lib/test/test_re.py
+++ b/Lib/test/test_re.py
@@ -2418,6 +2418,16 @@ class ReTests(unittest.TestCase):
                 p.terminate()
                 p.join()
 
+    def test_sre_template_invalid_group_index(self):
+        # see gh-106524
+        import _sre
+        with self.assertRaises(TypeError) as cm:
+            _sre.template("", ["", -1, ""])
+        self.assertIn("invalid template", str(cm.exception))
+        with self.assertRaises(TypeError) as cm:
+            _sre.template("", ["", (), ""])
+        self.assertIn("an integer is required", str(cm.exception))
+
 
 def get_debug_out(pat):
     with captured_stdout() as out:

diff --git a/Misc/NEWS.d/next/Library/2023-07-07-17-44-03.gh-issue-106524.XkBV8h.rst b/Misc/NEWS.d/next/Library/2023-07-07-17-44-03.gh-issue-106524.XkBV8h.rst
new file mode 100644 (file)
index 0000000..f3fd070
--- /dev/null
+++ b/Misc/NEWS.d/next/Library/2023-07-07-17-44-03.gh-issue-106524.XkBV8h.rst
@@ -0,0 +1 @@
+Fix crash in :func:`!_sre.template` with templates containing invalid group indices.

diff --git a/Modules/_sre/sre.c b/Modules/_sre/sre.c
index 3f11916f9e17261c5b2f3c8d347fb40d228178a4..98602b4c1eaaf1a81cf6c21ae741379d406a1d68 100644 (file)
--- a/Modules/_sre/sre.c
+++ b/Modules/_sre/sre.c
@@ -1544,10 +1544,12 @@ _sre_template_impl(PyObject *module, PyObject *pattern, PyObject *template)
     for (Py_ssize_t i = 0; i < n; i++) {
         Py_ssize_t index = PyLong_AsSsize_t(PyList_GET_ITEM(template, 2*i+1));
         if (index == -1 && PyErr_Occurred()) {
+            Py_SET_SIZE(self, i);
             Py_DECREF(self);
             return NULL;
         }
         if (index < 0) {
+            Py_SET_SIZE(self, i);
             goto bad_template;
         }
         self->items[i].index = index;