Skip to content

[3.11] gh-109098: Fuzz re module instead of internal sre (GH-109911) #109933

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Sep 27, 2023
Merged

[3.11] gh-109098: Fuzz re module instead of internal sre (GH-109911) #109933

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 16 additions & 20 deletions Modules/_xxtestfuzz/fuzzer.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -188,37 +188,33 @@ static int fuzz_json_loads(const char* data, size_t size) {

#define MAX_RE_TEST_SIZE 0x10000

PyObject* sre_compile_method = NULL;
PyObject* sre_error_exception = NULL;
int SRE_FLAG_DEBUG = 0;
PyObject* re_compile_method = NULL;
PyObject* re_error_exception = NULL;
int RE_FLAG_DEBUG = 0;
/* Called by LLVMFuzzerTestOneInput for initialization */
static int init_sre_compile(void) {
/* Import sre_compile.compile and sre.error */
PyObject* sre_compile_module = PyImport_ImportModule("sre_compile");
if (sre_compile_module == NULL) {
PyObject* re_module = PyImport_ImportModule("re");
if (re_module == NULL) {
return 0;
}
sre_compile_method = PyObject_GetAttrString(sre_compile_module, "compile");
if (sre_compile_method == NULL) {
re_compile_method = PyObject_GetAttrString(re_module, "compile");
if (re_compile_method == NULL) {
return 0;
}

PyObject* sre_constants = PyImport_ImportModule("sre_constants");
if (sre_constants == NULL) {
return 0;
}
sre_error_exception = PyObject_GetAttrString(sre_constants, "error");
if (sre_error_exception == NULL) {
re_error_exception = PyObject_GetAttrString(re_module, "error");
if (re_error_exception == NULL) {
return 0;
}
PyObject* debug_flag = PyObject_GetAttrString(sre_constants, "SRE_FLAG_DEBUG");
PyObject* debug_flag = PyObject_GetAttrString(re_module, "DEBUG");
if (debug_flag == NULL) {
return 0;
}
SRE_FLAG_DEBUG = PyLong_AsLong(debug_flag);
RE_FLAG_DEBUG = PyLong_AsLong(debug_flag);
return 1;
}
/* Fuzz _sre.compile(x) */
/* Fuzz re.compile(x) */
static int fuzz_sre_compile(const char* data, size_t size) {
/* Ignore really long regex patterns that will timeout the fuzzer */
if (size > MAX_RE_TEST_SIZE) {
Expand All @@ -231,7 +227,7 @@ static int fuzz_sre_compile(const char* data, size_t size) {
uint16_t flags = ((uint16_t*) data)[0];
/* We remove the SRE_FLAG_DEBUG if present. This is because it
prints to stdout which greatly decreases fuzzing speed */
flags &= ~SRE_FLAG_DEBUG;
flags &= ~RE_FLAG_DEBUG;

/* Pull the pattern from the remaining bytes */
PyObject* pattern_bytes = PyBytes_FromStringAndSize(data + 2, size - 2);
Expand All @@ -244,9 +240,9 @@ static int fuzz_sre_compile(const char* data, size_t size) {
return 0;
}

/* compiled = _sre.compile(data[2:], data[0:2] */
/* compiled = re.compile(data[2:], data[0:2] */
PyObject* compiled = PyObject_CallFunctionObjArgs(
sre_compile_method, pattern_bytes, flags_obj, NULL);
re_compile_method, pattern_bytes, flags_obj, NULL);
/* Ignore ValueError as the fuzzer will more than likely
generate some invalid combination of flags */
if (compiled == NULL && PyErr_ExceptionMatches(PyExc_ValueError)) {
Expand All @@ -262,7 +258,7 @@ static int fuzz_sre_compile(const char* data, size_t size) {
PyErr_Clear();
}
/* Ignore re.error */
if (compiled == NULL && PyErr_ExceptionMatches(sre_error_exception)) {
if (compiled == NULL && PyErr_ExceptionMatches(re_error_exception)) {
PyErr_Clear();
}

Expand Down
6 changes: 3 additions & 3 deletions Tools/c-analyzer/cpython/ignored.tsv
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -243,15 +243,15 @@ Modules/_testmultiphase.c - testexport_methods -
Modules/_testmultiphase.c - uninitialized_def -
Modules/_xxtestfuzz/_xxtestfuzz.c - _fuzzmodule -
Modules/_xxtestfuzz/_xxtestfuzz.c - module_methods -
Modules/_xxtestfuzz/fuzzer.c - SRE_FLAG_DEBUG -
Modules/_xxtestfuzz/fuzzer.c - RE_FLAG_DEBUG -
Modules/_xxtestfuzz/fuzzer.c - ast_literal_eval_method -
Modules/_xxtestfuzz/fuzzer.c - compiled_patterns -
Modules/_xxtestfuzz/fuzzer.c - csv_error -
Modules/_xxtestfuzz/fuzzer.c - csv_module -
Modules/_xxtestfuzz/fuzzer.c - json_loads_method -
Modules/_xxtestfuzz/fuzzer.c - regex_patterns -
Modules/_xxtestfuzz/fuzzer.c - sre_compile_method -
Modules/_xxtestfuzz/fuzzer.c - sre_error_exception -
Modules/_xxtestfuzz/fuzzer.c - re_compile_method -
Modules/_xxtestfuzz/fuzzer.c - re_error_exception -
Modules/_xxtestfuzz/fuzzer.c - struct_error -
Modules/_xxtestfuzz/fuzzer.c - struct_unpack_method -
Modules/_xxtestfuzz/fuzzer.c LLVMFuzzerTestOneInput CSV_READER_INITIALIZED -
Expand Down