[Python-checkins] r69943 - sandbox/trunk/mmap/Modules/mmapmodule.c

[hirokazu.yamamoto]

Author: hirokazu.yamamoto
Date: Tue Feb 24 21:21:57 2009
New Revision: 69943

Log:
mmap.move crashed by integer overflow. See http://www.nabble.com/Segv-in-mmap.move()-td18617044.html
I think mmap.move should raise ValueError for negative value though.

import mmap
data = mmap.mmap(-1, 1)
data.move(1,1,-1) # crash

Modified:
   sandbox/trunk/mmap/Modules/mmapmodule.c

Modified: sandbox/trunk/mmap/Modules/mmapmodule.c
==============================================================================
--- sandbox/trunk/mmap/Modules/mmapmodule.c	(original)
+++ sandbox/trunk/mmap/Modules/mmapmodule.c	Tue Feb 24 21:21:57 2009
@@ -606,10 +606,8 @@
 		return NULL;
 	} else {
 		/* bounds check the values */
-		if (/* end of source after end of data?? */
-			((src+count) > self->size)
-			/* dest will fit? */
-			|| (dest+count > self->size)) {
+		unsigned long pos = max(src, dest);
+		if (self->size >= pos && count > self->size - pos) {
 			PyErr_SetString(PyExc_ValueError,
 					"source or destination out of range");
 			return NULL;