[New-bugs-announce] [issue10467] io.BytesIO.readinto() segfaults when used on BytesIO object seeked beyond end.

[Sebastian Hagen]

New submission from Sebastian Hagen <sh_pybugs at memespace.net>:

io.BytesIO().readinto() does not correctly handle the case of being called on a BytesIO object that has been seeked past the end of its data. It consequently ends up reading into unallocated memory, and (typically?) segfaulting if used in this manner. I've confirmed that this bug exists in the same fashion in 2.6, 2.7, 3.0, 3.1 and 3.2; the following demonstration code works on all of these.

Demonstration:
>>> import io; b = io.BytesIO(b'bytes'); b.seek(42); b.readinto(bytearray(1))
42
Segmentation fault

I'm attaching a simple patch against r32a3:85355 that fixes this problem.

----------
components: IO
files: bio_readinto_1.patch
keywords: patch
messages: 121618
nosy: sh
priority: normal
severity: normal
status: open
title: io.BytesIO.readinto() segfaults when used on BytesIO object seeked beyond end.
type: crash
versions: Python 2.6, Python 2.7, Python 3.1, Python 3.2
Added file: http://bugs.python.org/file19656/bio_readinto_1.patch

_______________________________________
Python tracker <report at bugs.python.org>
<http://bugs.python.org/issue10467>
_______________________________________