gh-127971: do not read past the end of a string

duaneg · duaneg · commit f0d20b254e24 · 2025-04-15T20:56:59.000+12:00
Fix off-by-one read beyond the end of a string.
diff --git a/Objects/stringlib/fastsearch.h b/Objects/stringlib/fastsearch.h
@@ -595,7 +595,7 @@ STRINGLIB(default_find)(const STRINGLIB_CHAR* s, Py_ssize_t n,
                 continue;
             }
             /* miss: check if next character is part of pattern */
-            if (!STRINGLIB_BLOOM(mask, ss[i+1])) {
+            if (i < w && !STRINGLIB_BLOOM(mask, ss[i+1])) {
                 i = i + m;
             }
             else {
@@ -604,7 +604,7 @@ STRINGLIB(default_find)(const STRINGLIB_CHAR* s, Py_ssize_t n,
         }
         else {
             /* skip: check if next character is part of pattern */
-            if (!STRINGLIB_BLOOM(mask, ss[i+1])) {
+            if (i < w && !STRINGLIB_BLOOM(mask, ss[i+1])) {
                 i = i + m;
             }
         }

Original file line number	Diff line number	Diff line change
`@@ -595,7 +595,7 @@ STRINGLIB(default_find)(const STRINGLIB_CHAR* s, Py_ssize_t n,`
`595`	`595`	`continue;`
`596`	`596`	`}`
`597`	`597`	`/* miss: check if next character is part of pattern */`
`598`		`- if (!STRINGLIB_BLOOM(mask, ss[i+1])) {`
	`598`	`+ if (i < w && !STRINGLIB_BLOOM(mask, ss[i+1])) {`
`599`	`599`	`i = i + m;`
`600`	`600`	`}`
`601`	`601`	`else {`
`@@ -604,7 +604,7 @@ STRINGLIB(default_find)(const STRINGLIB_CHAR* s, Py_ssize_t n,`
`604`	`604`	`}`
`605`	`605`	`else {`
`606`	`606`	`/* skip: check if next character is part of pattern */`
`607`		`- if (!STRINGLIB_BLOOM(mask, ss[i+1])) {`
	`607`	`+ if (i < w && !STRINGLIB_BLOOM(mask, ss[i+1])) {`
`608`	`608`	`i = i + m;`
`609`	`609`	`}`
`610`	`610`	`}`