[issue42150] Buffer overflow in bad_single_statement (Parser/pegen.c)

miss-islington added the comment: New changeset 0b290dd2171e745d94f48298cafb2327eb2de17c by Miss Skeleton (bot) in branch '3.9': bpo-42150: Avoid buffer overflow in the new parser (GH-22978) https://github.com/python/cpython/commit/0b290dd2171e745d94f48298cafb2327eb2de17c -- __

[issue42150] Buffer overflow in bad_single_statement (Parser/pegen.c)

Change by Pablo Galindo Salgado : -- resolution: -> fixed stage: -> resolved status: open -> closed ___ Python tracker ___ ___ Pyt

[issue42150] Buffer overflow in bad_single_statement (Parser/pegen.c)

Change by miss-islington : -- nosy: +miss-islington nosy_count: 2.0 -> 3.0 pull_requests: +21896 pull_request: https://github.com/python/cpython/pull/22979 ___ Python tracker _

[issue42150] Buffer overflow in bad_single_statement (Parser/pegen.c)

Pablo Galindo Salgado added the comment: New changeset e68c67805e6a4c4ec80bea64be0e8373cc02d322 by Pablo Galindo in branch 'master': bpo-42150: Avoid buffer overflow in the new parser (GH-22978) https://github.com/python/cpython/commit/e68c67805e6a4c4ec80bea64be0e8373cc02d322 -- __

[issue42150] Buffer overflow in bad_single_statement (Parser/pegen.c)

Pablo Galindo Salgado added the comment: Check the errors in this new builder I have prepared: https://buildbot.python.org/all/#/builders/582/builds/200/steps/5/logs/stdio -- stage: patch review -> ___ Python tracker

[issue42150] Buffer overflow in bad_single_statement (Parser/pegen.c)

Pablo Galindo Salgado added the comment: The problem seems to be that when we do const char *cur = strchr(p->tok->buf, '\n'); ... *(cur - 1) == '\\' we don't check if "cur" is before at p->tok->buf (and therefore we cannot check the previous char) -- __

[issue42150] Buffer overflow in bad_single_statement (Parser/pegen.c)

Change by Pablo Galindo Salgado : -- keywords: +patch pull_requests: +21895 stage: -> patch review pull_request: https://github.com/python/cpython/pull/22978 ___ Python tracker __

[issue42150] Buffer overflow in bad_single_statement (Parser/pegen.c)

New submission from Pablo Galindo Salgado : Building Python with the address sanitizer and executing ./python -m test test_repl -v shows this: === ==26216==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6023990f at pc 0x5