| commit | 55d5bfba9482d39080f7b9ec3e6257ecd23f264f | [log] [tgz] |
|---|---|---|
| author | Jamie Davis <davisjam@vt.edu> | Tue Mar 06 00:59:02 2018 -0500 |
| committer | Benjamin Peterson <benjamin@python.org> | Mon Mar 05 21:59:02 2018 -0800 |
| tree | fe770dee608b13e72312faab4e96780891a77fb3 | |
| parent | e052d40cea15f582b50947f7d906b39744dc62a2 [diff] |
[2.7] closes bpo-32997: Fix REDOS in fpformat (GH-5984) The regex to decode a number in fpformat is susceptible to catastrophic backtracking. This is a potential DOS vector if a server is using fpformat on untrusted number strings. Replace it with an equivalent non-vulnerable regex. The match behavior of the new regex is slightly different. It captures the whole integer part of the number in one group, Leading zeros are stripped off later.