From d6cf5c674952d5ae3463d9b580dac6559576deac Mon Sep 17 00:00:00 2001
From: Jeff Epler <jepler@gmail.com>
Date: Sat, 31 Mar 2018 21:27:56 -0500
Subject: [PATCH] py/objstr: In find/rfind, don't crash when end < start.

---
 py/objstr.c                  | 5 +++++
 tests/basics/string_find.py  | 1 +
 tests/basics/string_rfind.py | 1 +
 3 files changed, 7 insertions(+)

diff --git a/py/objstr.c b/py/objstr.c
index 0b11533f8..da925234e 100644
--- a/py/objstr.c
+++ b/py/objstr.c
@@ -699,8 +699,13 @@ STATIC mp_obj_t str_finder(size_t n_args, const mp_obj_t *args, int direction, b
         end = str_index_to_ptr(self_type, haystack, haystack_len, args[3], true);
     }
 
+    if (end < start) {
+        goto out_error;
+    }
+
     const byte *p = find_subbytes(start, end - start, needle, needle_len, direction);
     if (p == NULL) {
+    out_error:
         // not found
         if (is_index) {
             mp_raise_ValueError("substring not found");
diff --git a/tests/basics/string_find.py b/tests/basics/string_find.py
index 4a206eb0e..f9fcad3e5 100644
--- a/tests/basics/string_find.py
+++ b/tests/basics/string_find.py
@@ -21,6 +21,7 @@ print("0000".find('-1', 3))
 print("0000".find('1', 3))
 print("0000".find('1', 4))
 print("0000".find('1', 5))
+print("aaaaaaaaaaa".find("bbb", 9, 2))
 
 try:
     'abc'.find(1)
diff --git a/tests/basics/string_rfind.py b/tests/basics/string_rfind.py
index 4d0e84018..54269d6f5 100644
--- a/tests/basics/string_rfind.py
+++ b/tests/basics/string_rfind.py
@@ -21,3 +21,4 @@ print("0000".rfind('-1', 3))
 print("0000".rfind('1', 3))
 print("0000".rfind('1', 4))
 print("0000".rfind('1', 5))
+print("aaaaaaaaaaa".rfind("bbb", 9, 2))
-- 
GitLab