[Python-checkins] r70879 - in python/trunk: Lib/test/test_mmap.py Modules/mmapmodule.c

[hirokazu.yamamoto]

Author: hirokazu.yamamoto
Date: Tue Mar 31 22:14:04 2009
New Revision: 70879

Log:
Issue #5387: Fixed mmap.move crash by integer overflow. (take2)

Modified:
   python/trunk/Lib/test/test_mmap.py
   python/trunk/Modules/mmapmodule.c

Modified: python/trunk/Lib/test/test_mmap.py
==============================================================================
--- python/trunk/Lib/test/test_mmap.py	(original)
+++ python/trunk/Lib/test/test_mmap.py	Tue Mar 31 22:14:04 2009
@@ -1,6 +1,6 @@
 from test.test_support import TESTFN, run_unittest, import_module
 import unittest
-import os, re
+import os, re, itertools
 
 mmap = import_module('mmap')
 
@@ -351,9 +351,21 @@
                     self.assertEqual(m[:], expected)
                     m.close()
 
-        # should not crash
-        m = mmap.mmap(-1, 1)
-        self.assertRaises(ValueError, m.move, 1, 1, -1)
+        # segfault test (Issue 5387)
+        m = mmap.mmap(-1, 100)
+        offsets = [-100, -1, 0, 1, 100]
+        for source, dest, size in itertools.product(offsets, offsets, offsets):
+            try:
+                m.move(source, dest, size)
+            except ValueError:
+                pass
+        self.assertRaises(ValueError, m.move, -1, -1, -1)
+        self.assertRaises(ValueError, m.move, -1, -1, 0)
+        self.assertRaises(ValueError, m.move, -1, 0, -1)
+        self.assertRaises(ValueError, m.move, 0, -1, -1)
+        self.assertRaises(ValueError, m.move, -1, 0, 0)
+        self.assertRaises(ValueError, m.move, 0, -1, 0)
+        self.assertRaises(ValueError, m.move, 0, 0, -1)
         m.close()
 
     def test_anonymous(self):

Modified: python/trunk/Modules/mmapmodule.c
==============================================================================
--- python/trunk/Modules/mmapmodule.c	(original)
+++ python/trunk/Modules/mmapmodule.c	Tue Mar 31 22:14:04 2009
@@ -617,7 +617,7 @@
 	} else {
 		/* bounds check the values */
 		unsigned long pos = src > dest ? src : dest;
-		if (self->size >= pos && count > self->size - pos) {
+		if (self->size < pos || count > self->size - pos) {
 			PyErr_SetString(PyExc_ValueError,
 					"source or destination out of range");
 			return NULL;