From: Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com>
Date: Tue, 4 Nov 2025 16:16:40 +0000 (+0100)
Subject: [3.13] gh-140979: Fix off-by-one error in the RE code validator (GH-140984) (GH-141000)
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=fd9be78f4e43b2467411a206b54d49aba2763a49;p=thirdparty%2FPython%2Fcpython.git

[3.13] gh-140979: Fix off-by-one error in the RE code validator (GH-140984) (GH-141000)

It was too lenient and allowed MARK opcodes with too large value.
(cherry picked from commit 1326d2a808245e5f2de9e515460bab30556e8f05)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
---

diff --git a/Modules/_sre/sre.c b/Modules/_sre/sre.c
index 898ebbfe89bc..c0cc8268d2de 100644
--- a/Modules/_sre/sre.c
+++ b/Modules/_sre/sre.c
@@ -1932,7 +1932,7 @@ _validate_inner(SRE_CODE *code, SRE_CODE *end, Py_ssize_t groups)
                sre_match() code is robust even if they don't, and the worst
                you can get is nonsensical match results. */
             GET_ARG;
-            if (arg > 2 * (size_t)groups + 1) {
+            if (arg >= 2 * (size_t)groups) {
                 VTRACE(("arg=%d, groups=%d\n", (int)arg, (int)groups));
                 FAIL;
             }