Repository navigation
Commit 85ec3b3
File tree
- Lib/test
- Misc/NEWS.d/next/Core_and_Builtins
- Objects/stringlib
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -767,6 +767,15 @@ def test_replace(self): | |||
| 767 | 767 | self.checkraises(TypeError, 'hello', 'replace', 42, 'h') | |
| 768 | 768 | self.checkraises(TypeError, 'hello', 'replace', 'h', 42) | |
| 769 | 769 | ||
| 770 | + def test_replacement_on_buffer_boundary(self): | ||
| 771 | + # gh-127971: Check we don't read past the end of the buffer when a | ||
| 772 | + # potential match misses on the last character. | ||
| 773 | + any_3_nonblank_codepoints = '!!!' | ||
| 774 | + seven_codepoints = any_3_nonblank_codepoints + ' ' + any_3_nonblank_codepoints | ||
| 775 | + a = (' ' * 243) + seven_codepoints + (' ' * 7) | ||
| 776 | + b = ' ' * 6 + chr(256) | ||
| 777 | + a.replace(seven_codepoints, b) | ||
| 778 | + | ||
| 770 | 779 | def test_replace_uses_two_way_maxcount(self): | |
| 771 | 780 | # Test that maxcount works in _two_way_count in fastsearch.h | |
| 772 | 781 | A, B = "A"*1000, "B"*1000 | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -0,0 +1 @@ | |||
| 1 | + Fix off-by-one read beyond the end of a string in string search. | ||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -595,7 +595,7 @@ STRINGLIB(default_find)(const STRINGLIB_CHAR* s, Py_ssize_t n, | |||
| 595 | 595 | continue; | |
| 596 | 596 | } | |
| 597 | 597 | /* miss: check if next character is part of pattern */ | |
| 598 | - if (!STRINGLIB_BLOOM(mask, ss[i+1])) { | ||
| 598 | + if (i + 1 <= w && !STRINGLIB_BLOOM(mask, ss[i+1])) { | ||
| 599 | 599 | i = i + m; | |
| 600 | 600 | } | |
| 601 | 601 | else { | |
@@ -604,7 +604,7 @@ STRINGLIB(default_find)(const STRINGLIB_CHAR* s, Py_ssize_t n, | |||
| 604 | 604 | } | |
| 605 | 605 | else { | |
| 606 | 606 | /* skip: check if next character is part of pattern */ | |
| 607 | - if (!STRINGLIB_BLOOM(mask, ss[i+1])) { | ||
| 607 | + if (i + 1 <= w && !STRINGLIB_BLOOM(mask, ss[i+1])) { | ||
| 608 | 608 | i = i + m; | |
| 609 | 609 | } | |
| 610 | 610 | } | |
@@ -668,7 +668,7 @@ STRINGLIB(adaptive_find)(const STRINGLIB_CHAR* s, Py_ssize_t n, | |||
| 668 | 668 | } | |
| 669 | 669 | } | |
| 670 | 670 | /* miss: check if next character is part of pattern */ | |
| 671 | - if (!STRINGLIB_BLOOM(mask, ss[i+1])) { | ||
| 671 | + if (i + 1 <= w && !STRINGLIB_BLOOM(mask, ss[i+1])) { | ||
| 672 | 672 | i = i + m; | |
| 673 | 673 | } | |
| 674 | 674 | else { | |
@@ -677,7 +677,7 @@ STRINGLIB(adaptive_find)(const STRINGLIB_CHAR* s, Py_ssize_t n, | |||
| 677 | 677 | } | |
| 678 | 678 | else { | |
| 679 | 679 | /* skip: check if next character is part of pattern */ | |
| 680 | - if (!STRINGLIB_BLOOM(mask, ss[i+1])) { | ||
| 680 | + if (i + 1 <= w && !STRINGLIB_BLOOM(mask, ss[i+1])) { | ||
| 681 | 681 | i = i + m; | |
| 682 | 682 | } | |
| 683 | 683 | } | |
0 commit comments