commit 0560e8a8f8e737688a377a0e934a892100fa19d0
author Antoine Pitrou <solipsis@pitrou.net> Thu Jan 14 17:37:24 2010 +0000
committer Antoine Pitrou <solipsis@pitrou.net> Thu Jan 14 17:37:24 2010 +0000
tree dbdb85da00db2f21623eb77c6cf954da00c6fa89
parent 9000c1614d183345165271c42926da80102a2a36

Merged revisions 77501 via svnmerge from
svn+ssh://pythondev@svn.python.org/python/branches/py3k

................
  r77501 | antoine.pitrou | 2010-01-14 18:34:48 +0100 (jeu., 14 janv. 2010) | 10 lines

  Merged revisions 77499 via svnmerge from
  svn+ssh://pythondev@svn.python.org/python/trunk

  ........
    r77499 | antoine.pitrou | 2010-01-14 18:25:24 +0100 (jeu., 14 janv. 2010) | 4 lines

    Issue #3299: Fix possible crash in the _sre module when given bad
    argument values in debug mode.  Patch by Victor Stinner.
  ........
................

Lib/test/test_re.py

diff --git a/Lib/test/test_re.py b/Lib/test/test_re.py
index 383b56a..7ef57e1 100644
--- a/Lib/test/test_re.py
+++ b/Lib/test/test_re.py
@@ -696,6 +696,12 @@
         self.assertRaises(ValueError, re.compile, '(?a)\w', re.UNICODE)
         self.assertRaises(ValueError, re.compile, '(?au)\w')
 
+    def test_dealloc(self):
+        # issue 3299: check for segfault in debug build
+        import _sre
+        long_overflow = sys.maxsize + 2
+        self.assertRaises(TypeError, re.finditer, "a", {})
+        self.assertRaises(OverflowError, _sre.compile, "abc", 0, [long_overflow])
 
 def run_re_tests():
     from test.re_tests import benchmarks, tests, SUCCEED, FAIL, SYNTAX_ERROR

Misc/NEWS

diff --git a/Misc/NEWS b/Misc/NEWS
index c91a22c..36c232e 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -65,6 +65,9 @@
 Library
 -------
 
+- Issue #3299: Fix possible crash in the _sre module when given bad
+  argument values in debug mode.  Patch by Victor Stinner.
+
 - Issue #7681: Use floor division in appropiate places in the wave module.
 
 - Issue #5372: Drop the reuse of .o files in Distutils' ccompiler (since

Modules/_sre.c

diff --git a/Modules/_sre.c b/Modules/_sre.c
index 45b92f3..74d9425 100644
--- a/Modules/_sre.c
+++ b/Modules/_sre.c
@@ -2674,6 +2674,10 @@
     self = PyObject_NEW_VAR(PatternObject, &Pattern_Type, n);
     if (!self)
         return NULL;
+    self->weakreflist = NULL;
+    self->pattern = NULL;
+    self->groupindex = NULL;
+    self->indexgroup = NULL;
 
     self->codesize = n;
 
@@ -2689,7 +2693,7 @@
     }
 
     if (PyErr_Occurred()) {
-        PyObject_DEL(self);
+        Py_DECREF(self);
         return NULL;
     }
 
@@ -3730,7 +3734,7 @@
 scanner_dealloc(ScannerObject* self)
 {
     state_fini(&self->state);
-    Py_DECREF(self->pattern);
+    Py_XDECREF(self->pattern);
     PyObject_DEL(self);
 }
 
@@ -3860,10 +3864,11 @@
     self = PyObject_NEW(ScannerObject, &Scanner_Type);
     if (!self)
         return NULL;
+    self->pattern = NULL;
 
     string = state_init(&self->state, pattern, string, start, end);
     if (!string) {
-        PyObject_DEL(self);
+        Py_DECREF(self);
         return NULL;
     }