From e68c67805e6a4c4ec80bea64be0e8373cc02d322 Mon Sep 17 00:00:00 2001 From: Pablo Galindo Date: Sun, 25 Oct 2020 23:03:41 +0000 Subject: [PATCH] bpo-42150: Avoid buffer overflow in the new parser (GH-22978) --- .../Core and Builtins/2020-10-25-21-14-18.bpo-42150.b70u_T.rst | 2 ++ Parser/pegen.c | 3 ++- 2 files changed, 4 insertions(+), 1 deletion(-) create mode 100644 Misc/NEWS.d/next/Core and Builtins/2020-10-25-21-14-18.bpo-42150.b70u_T.rst diff --git a/Misc/NEWS.d/next/Core and Builtins/2020-10-25-21-14-18.bpo-42150.b70u_T.rst b/Misc/NEWS.d/next/Core and Builtins/2020-10-25-21-14-18.bpo-42150.b70u_T.rst new file mode 100644 index 00000000000..62fabb857aa --- /dev/null +++ b/Misc/NEWS.d/next/Core and Builtins/2020-10-25-21-14-18.bpo-42150.b70u_T.rst @@ -0,0 +1,2 @@ +Fix possible buffer overflow in the new parser when checking for +continuation lines. Patch by Pablo Galindo. diff --git a/Parser/pegen.c b/Parser/pegen.c index efa5ed9f288..c7343f7f047 100644 --- a/Parser/pegen.c +++ b/Parser/pegen.c @@ -990,7 +990,8 @@ bad_single_statement(Parser *p) /* Newlines are allowed if preceded by a line continuation character or if they appear inside a string. */ - if (!cur || *(cur - 1) == '\\' || newline_in_string(p, cur)) { + if (!cur || (cur != p->tok->buf && *(cur - 1) == '\\') + || newline_in_string(p, cur)) { return 0; } char c = *cur;