From 0041df0c6b493458000d7e815e094995cfbc8043 Mon Sep 17 00:00:00 2001
From: Jeff Epler <jepler@gmail.com>
Date: Sat, 31 Mar 2018 21:27:56 -0500
Subject: py/objstr: Don't crash when end < start

.. and add testcases for the same.

(crash found by afl-fuzz)
---
 py/objstr.c | 5 +++++
 1 file changed, 5 insertions(+)

(limited to 'py')

diff --git a/py/objstr.c b/py/objstr.c
index 64306f54f..7ace1cf73 100644
--- a/py/objstr.c
+++ b/py/objstr.c
@@ -692,8 +692,13 @@ STATIC mp_obj_t str_finder(size_t n_args, const mp_obj_t *args, int direction, b
         end = str_index_to_ptr(self_type, haystack, haystack_len, args[3], true);
     }
 
+    if (end < start) {
+        goto out_error;
+    }
+
     const byte *p = find_subbytes(start, end - start, needle, needle_len, direction);
     if (p == NULL) {
+    out_error:
         // not found
         if (is_index) {
             mp_raise_ValueError("substring not found");
-- 
cgit v1.2.3