[Python-checkins] r88133 - in python/branches/release27-maint: Lib/test/test_mmap.py Misc/NEWS Modules/mmapmodule.c

[antoine.pitrou]

Author: antoine.pitrou
Date: Thu Jan 20 22:20:18 2011
New Revision: 88133

Log:
Merged revisions 88131 via svnmerge from 
svn+ssh://pythondev@svn.python.org/python/branches/py3k

........
  r88131 | antoine.pitrou | 2011-01-20 22:07:24 +0100 (jeu., 20 janv. 2011) | 6 lines
  
  Issue #10955: Fix a potential crash when trying to mmap() a file past its
  length.  Initial patch by Ross Lagerwall.
  
  This fixes a regression introduced by r88022.
........


Modified:
   python/branches/release27-maint/   (props changed)
   python/branches/release27-maint/Lib/test/test_mmap.py
   python/branches/release27-maint/Misc/NEWS
   python/branches/release27-maint/Modules/mmapmodule.c

Modified: python/branches/release27-maint/Lib/test/test_mmap.py
==============================================================================
--- python/branches/release27-maint/Lib/test/test_mmap.py	(original)
+++ python/branches/release27-maint/Lib/test/test_mmap.py	Thu Jan 20 22:20:18 2011
@@ -343,6 +343,19 @@
             finally:
                 mf.close()
 
+    def test_length_0_large_offset(self):
+        # Issue #10959: test mapping of a file by passing 0 for
+        # map length with a large offset doesn't cause a segfault.
+        if not hasattr(os, "stat"):
+            self.skipTest("needs os.stat")
+
+        with open(TESTFN, "wb") as f:
+            f.write(115699 * b'm') # Arbitrary character
+
+        with open(TESTFN, "w+b") as f:
+            self.assertRaises(ValueError, mmap.mmap, f.fileno(), 0,
+                              offset=2147418112)
+
     def test_move(self):
         # make move works everywhere (64-bit format problem earlier)
         f = open(TESTFN, 'w+')

Modified: python/branches/release27-maint/Misc/NEWS
==============================================================================
--- python/branches/release27-maint/Misc/NEWS	(original)
+++ python/branches/release27-maint/Misc/NEWS	Thu Jan 20 22:20:18 2011
@@ -35,6 +35,9 @@
 Library
 -------
 
+- Issue #10955: Fix a potential crash when trying to mmap() a file past its
+  length.  Initial patch by Ross Lagerwall.
+
 - Issue #10898: Allow compiling the posix module when the C library defines
   a symbol named FSTAT.
 

Modified: python/branches/release27-maint/Modules/mmapmodule.c
==============================================================================
--- python/branches/release27-maint/Modules/mmapmodule.c	(original)
+++ python/branches/release27-maint/Modules/mmapmodule.c	Thu Jan 20 22:20:18 2011
@@ -1164,6 +1164,11 @@
 #  endif
     if (fd != -1 && fstat(fd, &st) == 0 && S_ISREG(st.st_mode)) {
         if (map_size == 0) {
+            if (offset >= st.st_size) {
+                PyErr_SetString(PyExc_ValueError,
+                                "mmap offset is greater than file size");
+                return NULL;
+            }
             map_size = st.st_size - offset;
         } else if ((size_t)offset + (size_t)map_size > st.st_size) {
             PyErr_SetString(PyExc_ValueError,
@@ -1346,6 +1351,12 @@
             else
                 m_obj->size = low;
 #endif
+            if (offset >= m_obj->size) {
+                PyErr_SetString(PyExc_ValueError,
+                                "mmap offset is greater than file size");
+                Py_DECREF(m_obj);
+                return NULL;
+            }
             m_obj->size -= offset;
         } else {
             m_obj->size = map_size;