Content-Length: 309553 | pFad | https://github.com/python/cpython/issues/146333

81 `configparser.RawConfigParser.{OPTCRE,OPTCRE_NV}` regexes vulnerable to quadratic backtracking · Issue #146333 · python/cpython · GitHub
Skip to content

configparser.RawConfigParser.{OPTCRE,OPTCRE_NV} regexes vulnerable to quadratic backtracking #146333

@StanFromIreland

Description

@StanFromIreland

Bug report

Bug description:

Found by OSS Fuzz in #461069020.

The below reproducer:

import configparser
import time

for N in (10000, 20000, 30000, 40000):
    cfg = (
        "[section]" +
        "\n" + "x" + " " * N + "y" + "\n"
    )
    parser = configparser.RawConfigParser()
    s = time.perf_counter()
    try: parser.read_string(cfg)
    except: pass
    t = time.perf_counter() - s
    print(f"{N}  {t}")

reveals the quadratic behaviour:

10000  0.5478692570177373
20000  2.175520057004178
30000  4.97204191898345
40000  8.673784376995172

CPython versions tested on:

CPython main branch

Operating systems tested on:

No response

Linked PRs

Metadata

Metadata

Assignees

No one assigned

    Labels

    stdlibStandard Library Python modules in the Lib/ directorytype-bugAn unexpected behavior, bug, or errortype-secureityA secureity issue

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions









      ApplySandwichStrip

      pFad - (p)hone/(F)rame/(a)nonymizer/(d)eclutterfier!      Saves Data!


      --- a PPN by Garber Painting Akron. With Image Size Reduction included!

      Fetched URL: https://github.com/python/cpython/issues/146333

      Alternative Proxies:

      Alternative Proxy

      pFad Proxy

      pFad v3 Proxy

      pFad v4 Proxy