Staging
v0.5.1
https://github.com/python/cpython
Revision 55d5bfba9482d39080f7b9ec3e6257ecd23f264f authored by Jamie Davis on 06 March 2018, 05:59:02 UTC, committed by Benjamin Peterson on 06 March 2018, 05:59:02 UTC
The regex to decode a number in fpformat is susceptible to catastrophic backtracking. This is a potential DOS vector if a server is using fpformat on untrusted number strings.

Replace it with an equivalent non-vulnerable regex. The match behavior of the new regex is slightly different. It captures the whole integer part of the number in one group, Leading zeros are stripped off later.
1 parent e052d40
History
Tip revision: 55d5bfba9482d39080f7b9ec3e6257ecd23f264f authored by Jamie Davis on 06 March 2018, 05:59:02 UTC
[2.7] closes bpo-32997: Fix REDOS in fpformat (GH-5984)
Tip revision: 55d5bfb
File Mode Size
.github
Demo
Doc
Grammar
Include
Lib
Mac
Misc
Modules
Objects
PC
PCbuild
Parser
Python
RISCOS
Tools
.bzrignore -rw-r--r-- 552 bytes
.gitattributes -rw-r--r-- 809 bytes
.gitignore -rw-r--r-- 1.2 KB
.travis.yml -rw-r--r-- 3.6 KB
LICENSE -rw-r--r-- 12.5 KB
Makefile.pre.in -rw-r--r-- 48.1 KB
README -rw-r--r-- 54.4 KB
aclocal.m4 -rw-r--r-- 13.0 KB
config.guess -rwxr-xr-x 43.2 KB
config.sub -rwxr-xr-x 35.7 KB
configure -rwxr-xr-x 437.6 KB
configure.ac -rw-r--r-- 140.6 KB
install-sh -rwxr-xr-x 7.0 KB
pyconfig.h.in -rw-r--r-- 35.1 KB
setup.py -rw-r--r-- 98.2 KB

README

back to top