mirror of
https://github.com/openembedded/meta-openembedded.git
synced 2026-01-27 12:01:38 +01:00
2adb3d6734
Details: https://nvd.nist.gov/vuln/detail/CVE-2021-29063 Pick the patch referenced by the NVD advisory. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
52 lines
1.8 KiB
Diff
52 lines
1.8 KiB
Diff
From 2e196ba7e41a46b8cafa5971e559ca55171414dc Mon Sep 17 00:00:00 2001
|
|
From: Vinzent Steinberg <Vinzent.Steinberg@gmail.com>
|
|
Date: Wed, 10 Feb 2021 16:45:04 +0100
|
|
Subject: [PATCH] Fix ReDOS vulnerability
|
|
|
|
Fixes #548, with the workaround suggested by @yetingli.
|
|
|
|
CVE: CVE-2021-29063
|
|
Upstream-Status: Backport [https://github.com/mpmath/mpmath/commit/46d44c3c8f3244017fe1eb102d564eb4ab8ef750]
|
|
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
|
|
---
|
|
mpmath/ctx_mp.py | 4 ++--
|
|
mpmath/tests/test_convert.py | 10 ++++++++++
|
|
2 files changed, 12 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/mpmath/ctx_mp.py b/mpmath/ctx_mp.py
|
|
index 39fc941..93594dd 100644
|
|
--- a/mpmath/ctx_mp.py
|
|
+++ b/mpmath/ctx_mp.py
|
|
@@ -42,8 +42,8 @@
|
|
|
|
new = object.__new__
|
|
|
|
-get_complex = re.compile(r'^\(?(?P<re>[\+\-]?\d*\.?\d*(e[\+\-]?\d+)?)??'
|
|
- r'(?P<im>[\+\-]?\d*\.?\d*(e[\+\-]?\d+)?j)?\)?$')
|
|
+get_complex = re.compile(r'^\(?(?P<re>[\+\-]?\d*(\.\d*)?(e[\+\-]?\d+)?)??'
|
|
+ r'(?P<im>[\+\-]?\d*(\.\d*)?(e[\+\-]?\d+)?j)?\)?$')
|
|
|
|
if BACKEND == 'sage':
|
|
from sage.libs.mpmath.ext_main import Context as BaseMPContext
|
|
diff --git a/mpmath/tests/test_convert.py b/mpmath/tests/test_convert.py
|
|
index 3e2f555..cf1a91d 100644
|
|
--- a/mpmath/tests/test_convert.py
|
|
+++ b/mpmath/tests/test_convert.py
|
|
@@ -194,6 +194,16 @@ def test_mpmathify():
|
|
assert mpmathify('(1.2e-10 - 3.4e5j)') == mpc('1.2e-10', '-3.4e5')
|
|
assert mpmathify('1j') == mpc(1j)
|
|
|
|
+def test_issue548():
|
|
+ try:
|
|
+ # This expression is invalid, but may trigger the ReDOS vulnerability
|
|
+ # in the regular expression.
|
|
+ mpmathify('(' + '1' * 5000 + '!j')
|
|
+ except:
|
|
+ return
|
|
+ # The expression is invalid and should raise an exception.
|
|
+ assert False
|
|
+
|
|
def test_compatibility():
|
|
try:
|
|
import numpy as np
|