This issue tracker has been migrated to GitHub, and is currently read-only.
For more information, see the GitHub FAQs in the Python's Developer Guide.

Author andrewmcnamara
Recipients
Date 2004-12-21.08:10:54
SpamBayes Score
Marked as misclassified
Message-id
In-reply-to
Content
In _sre.c, data_stack_grow(), realloc'ed memory is not initialised 
before use. When complex regexps are used, this results in a core 
dump.

Initialising the newly allocated memory to 0x55 and executing an 
offending regexp results in a fatal reference to an address like 
0x55555558:

static int
data_stack_grow(SRE_STATE* state, int size)
{
    int minsize, cursize;
    minsize = state->data_stack_base+size;
    cursize = state->data_stack_size;
    if (cursize < minsize) {
        void* stack;
        cursize = minsize+minsize/4+1024;
        TRACE(("allocate/grow stack %d\n", cursize));
        stack = realloc(state->data_stack, cursize);
        if (!stack) {
            data_stack_dealloc(state);
            return SRE_ERROR_MEMORY;
        }
        memset(stack+state->data_stack_size, 0x55, cursize-state-
>data_stack_size);
        state->data_stack = stack;
        state->data_stack_size = cursize;
    }
    return 0;
}
History
Date User Action Args
2007-08-23 14:28:37adminlinkissue1088891 messages
2007-08-23 14:28:37admincreate