Skip to content

configparser.RawConfigParser.{OPTCRE,OPTCRE_NV} regexes vulnerable to quadratic backtracking #146333

@StanFromIreland

Description

@StanFromIreland

Bug report

Bug description:

Found by OSS Fuzz in #461069020.

The below reproducer:

import configparser
import time

for N in (10000, 20000, 30000, 40000):
    cfg = (
        "[section]" +
        "\n" + "x" + " " * N + "y" + "\n"
    )
    parser = configparser.RawConfigParser()
    s = time.perf_counter()
    try: parser.read_string(cfg)
    except: pass
    t = time.perf_counter() - s
    print(f"{N}  {t}")

reveals the quadratic behaviour:

10000  0.5478692570177373
20000  2.175520057004178
30000  4.97204191898345
40000  8.673784376995172

CPython versions tested on:

CPython main branch

Operating systems tested on:

No response

Metadata

Metadata

Assignees

No one assigned

    Labels

    stdlibStandard Library Python modules in the Lib/ directorytype-bugAn unexpected behavior, bug, or errortype-securityA security issue

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions