blob: 3674a32ea16e71fa941f2a8bc900fc78b7f0a670 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
|
From 2e196ba7e41a46b8cafa5971e559ca55171414dc Mon Sep 17 00:00:00 2001
From: Vinzent Steinberg <Vinzent.Steinberg@gmail.com>
Date: Wed, 10 Feb 2021 16:45:04 +0100
Subject: [PATCH] Fix ReDOS vulnerability
Fixes #548, with the workaround suggested by @yetingli.
CVE: CVE-2021-29063
Upstream-Status: Backport [https://github.com/mpmath/mpmath/commit/46d44c3c8f3244017fe1eb102d564eb4ab8ef750]
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
---
mpmath/ctx_mp.py | 4 ++--
mpmath/tests/test_convert.py | 10 ++++++++++
2 files changed, 12 insertions(+), 2 deletions(-)
diff --git a/mpmath/ctx_mp.py b/mpmath/ctx_mp.py
index 39fc941..93594dd 100644
--- a/mpmath/ctx_mp.py
+++ b/mpmath/ctx_mp.py
@@ -42,8 +42,8 @@
new = object.__new__
-get_complex = re.compile(r'^\(?(?P<re>[\+\-]?\d*\.?\d*(e[\+\-]?\d+)?)??'
- r'(?P<im>[\+\-]?\d*\.?\d*(e[\+\-]?\d+)?j)?\)?$')
+get_complex = re.compile(r'^\(?(?P<re>[\+\-]?\d*(\.\d*)?(e[\+\-]?\d+)?)??'
+ r'(?P<im>[\+\-]?\d*(\.\d*)?(e[\+\-]?\d+)?j)?\)?$')
if BACKEND == 'sage':
from sage.libs.mpmath.ext_main import Context as BaseMPContext
diff --git a/mpmath/tests/test_convert.py b/mpmath/tests/test_convert.py
index 3e2f555..cf1a91d 100644
--- a/mpmath/tests/test_convert.py
+++ b/mpmath/tests/test_convert.py
@@ -194,6 +194,16 @@ def test_mpmathify():
assert mpmathify('(1.2e-10 - 3.4e5j)') == mpc('1.2e-10', '-3.4e5')
assert mpmathify('1j') == mpc(1j)
+def test_issue548():
+ try:
+ # This expression is invalid, but may trigger the ReDOS vulnerability
+ # in the regular expression.
+ mpmathify('(' + '1' * 5000 + '!j')
+ except:
+ return
+ # The expression is invalid and should raise an exception.
+ assert False
+
def test_compatibility():
try:
import numpy as np
|
