bpo-42150: Avoid buffer overflow in the new parser (GH-22978)

pablogsal · web-flow · commit e68c67805e6a · 2020-10-25T23:03:41.000Z
diff --git a/Misc/NEWS.d/next/Core and Builtins/2020-10-25-21-14-18.bpo-42150.b70u_T.rst b/Misc/NEWS.d/next/Core and Builtins/2020-10-25-21-14-18.bpo-42150.b70u_T.rst
@@ -0,0 +1,2 @@
+Fix possible buffer overflow in the new parser when checking for
+continuation lines. Patch by Pablo Galindo.
diff --git a/Parser/pegen.c b/Parser/pegen.c
@@ -990,7 +990,8 @@ bad_single_statement(Parser *p)
 
     /* Newlines are allowed if preceded by a line continuation character
        or if they appear inside a string. */
-    if (!cur || *(cur - 1) == '\\' || newline_in_string(p, cur)) {
+    if (!cur || (cur != p->tok->buf && *(cur - 1) == '\\')
+             || newline_in_string(p, cur)) {
         return 0;
     }
     char c = *cur;

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	`+Fix possible buffer overflow in the new parser when checking for`
	`2`	`+continuation lines. Patch by Pablo Galindo.`
Original file line number	Diff line number	Diff line change
`@@ -990,7 +990,8 @@ bad_single_statement(Parser *p)`
`990`	`990`
`991`	`991`	`/* Newlines are allowed if preceded by a line continuation character`
`992`	`992`	`or if they appear inside a string. */`
`993`		`- if (!cur \|\| *(cur - 1) == '\\' \|\| newline_in_string(p, cur)) {`
	`993`	`+ if (!cur \|\| (cur != p->tok->buf && *(cur - 1) == '\\')`
	`994`	`+ \|\| newline_in_string(p, cur)) {`
`994`	`995`	`return 0;`
`995`	`996`	`}`
`996`	`997`	`char c = *cur;`