[Python-checkins] r73685 - in python/branches/release31-maint: Misc/NEWS Modules/mmapmodule.c

Mon Jun 29 17:02:36 CEST 2009

Author: hirokazu.yamamoto
Date: Mon Jun 29 17:02:36 2009
New Revision: 73685
Log:
Merged revisions 73684 via svnmerge from 
svn+ssh://pythondev@svn.python.org/python/branches/py3k
................
 r73684 | hirokazu.yamamoto | 2009年06月29日 23:54:12 +0900 | 14 lines
 
 Merged revisions 73677,73681 via svnmerge from 
 svn+ssh://pythondev@svn.python.org/python/trunk
 
 ........
 r73677 | hirokazu.yamamoto | 2009年06月29日 22:25:16 +0900 | 2 lines
 
 Issue #6344: Fixed a crash of mmap.read() when passed a negative argument.
 Reviewed by Amaury Forgeot d'Arc.
 ........
 r73681 | hirokazu.yamamoto | 2009年06月29日 23:29:31 +0900 | 1 line
 
 Fixed NEWS.
 ........
................
Modified:
 python/branches/release31-maint/ (props changed)
 python/branches/release31-maint/Misc/NEWS
 python/branches/release31-maint/Modules/mmapmodule.c
Modified: python/branches/release31-maint/Misc/NEWS
==============================================================================

--- python/branches/release31-maint/Misc/NEWS	(original)
+++ python/branches/release31-maint/Misc/NEWS	Mon Jun 29 17:02:36 2009
@@ -15,6 +15,8 @@
 Library
 -------
 
+- Issue #6344: Fixed a crash of mmap.read() when passed a negative argument.
+
 Build
 -----
 
Modified: python/branches/release31-maint/Modules/mmapmodule.c
==============================================================================
--- python/branches/release31-maint/Modules/mmapmodule.c	(original)
+++ python/branches/release31-maint/Modules/mmapmodule.c	Mon Jun 29 17:02:36 2009
@@ -238,7 +238,7 @@
 mmap_read_method(mmap_object *self,
 		 PyObject *args)
 {
-	Py_ssize_t num_bytes;
+	Py_ssize_t num_bytes, n;
 	PyObject *result;
 
 	CHECK_VALID(NULL);
@@ -246,8 +246,18 @@
 		return(NULL);
 
 	/* silently 'adjust' out-of-range requests */
-	if (num_bytes > self->size - self->pos) {
-		num_bytes -= (self->pos+num_bytes) - self->size;
+	assert(self->size >= self->pos);
+	n = self->size - self->pos;
+	/* The difference can overflow, only if self->size is greater than
+	 * PY_SSIZE_T_MAX. But then the operation cannot possibly succeed,
+	 * because the mapped area and the returned string each need more 
+	 * than half of the addressable memory. So we clip the size, and let
+	 * the code below raise MemoryError.
+	 */
+	if (n < 0)
+		n = PY_SSIZE_T_MAX;
+	if (num_bytes < 0 || num_bytes > n) {
+		num_bytes = n;
 	}
 	result = PyBytes_FromStringAndSize(self->data+self->pos, num_bytes);
 	self->pos += num_bytes;
