Staging
v0.5.1
https://github.com/python/cpython
Revision 55d5bfba9482d39080f7b9ec3e6257ecd23f264f authored by Jamie Davis on 06 March 2018, 05:59:02 UTC, committed by Benjamin Peterson on 06 March 2018, 05:59:02 UTC
The regex to decode a number in fpformat is susceptible to catastrophic backtracking. This is a potential DOS vector if a server is using fpformat on untrusted number strings.

Replace it with an equivalent non-vulnerable regex. The match behavior of the new regex is slightly different. It captures the whole integer part of the number in one group, Leading zeros are stripped off later.
1 parent e052d40
History
Tip revision: 55d5bfba9482d39080f7b9ec3e6257ecd23f264f authored by Jamie Davis on 06 March 2018, 05:59:02 UTC
[2.7] closes bpo-32997: Fix REDOS in fpformat (GH-5984)
Tip revision: 55d5bfb
File Mode Size
c-api
data
distributing
distutils
extending
faq
howto
includes
install
installing
library
reference
tools
tutorial
using
whatsnew
Makefile -rw-r--r-- 6.1 KB
README.txt -rw-r--r-- 3.9 KB
about.rst -rw-r--r-- 1.5 KB
bugs.rst -rw-r--r-- 4.0 KB
conf.py -rw-r--r-- 5.8 KB
contents.rst -rw-r--r-- 538 bytes
copyright.rst -rw-r--r-- 451 bytes
docutils.conf -rw-r--r-- 56 bytes
glossary.rst -rw-r--r-- 35.8 KB
license.rst -rw-r--r-- 44.1 KB
make.bat -rw-r--r-- 4.0 KB

README.txt

back to top