[Python-checkins] r70803 - in python/branches/release26-maint: Lib/test/test_mmap.py Misc/NEWS Modules/mmapmodule.c

Tue Mar 31 15:22:02 CEST 2009

Author: hirokazu.yamamoto
Date: Tue Mar 31 15:22:01 2009
New Revision: 70803
Log:
Merged revisions 70800 via svnmerge from 
svn+ssh://pythondev@svn.python.org/python/trunk
........
 r70800 | hirokazu.yamamoto | 2009年03月31日 22:13:05 +0900 | 1 line
 
 Issue #5387: Fixed mmap.move crash by integer overflow.
........
Modified:
 python/branches/release26-maint/ (props changed)
 python/branches/release26-maint/Lib/test/test_mmap.py
 python/branches/release26-maint/Misc/NEWS
 python/branches/release26-maint/Modules/mmapmodule.c
Modified: python/branches/release26-maint/Lib/test/test_mmap.py
==============================================================================

--- python/branches/release26-maint/Lib/test/test_mmap.py	(original)
+++ python/branches/release26-maint/Lib/test/test_mmap.py	Tue Mar 31 15:22:01 2009
@@ -338,6 +338,23 @@
 mf.close()
 f.close()
 
+ # more excessive test
+ data = "0123456789"
+ for dest in range(len(data)):
+ for src in range(len(data)):
+ for count in range(len(data) - max(dest, src)):
+ expected = data[:dest] + data[src:src+count] + data[dest+count:]
+ m = mmap.mmap(-1, len(data))
+ m[:] = data
+ m.move(dest, src, count)
+ self.assertEqual(m[:], expected)
+ m.close()
+
+ # should not crash
+ m = mmap.mmap(-1, 1)
+ self.assertRaises(ValueError, m.move, 1, 1, -1)
+ m.close()
+
 def test_anonymous(self):
 # anonymous mmap.mmap(-1, PAGE)
 m = mmap.mmap(-1, PAGESIZE)
Modified: python/branches/release26-maint/Misc/NEWS
==============================================================================
--- python/branches/release26-maint/Misc/NEWS	(original)
+++ python/branches/release26-maint/Misc/NEWS	Tue Mar 31 15:22:01 2009
@@ -92,6 +92,8 @@
 Library
 -------
 
+- Issue #5387: Fixed mmap.move crash by integer overflow.
+
 - Issue #5261: Patch multiprocessing's semaphore.c to support context
 manager use: "with multiprocessing.Lock()" works now.
 
Modified: python/branches/release26-maint/Modules/mmapmodule.c
==============================================================================
--- python/branches/release26-maint/Modules/mmapmodule.c	(original)
+++ python/branches/release26-maint/Modules/mmapmodule.c	Tue Mar 31 15:22:01 2009
@@ -612,10 +612,8 @@
 		return NULL;
 	} else {
 		/* bounds check the values */
-		if (/* end of source after end of data?? */
-			((src+count) > self->size)
-			/* dest will fit? */
-			|| (dest+count > self->size)) {
+		unsigned long pos = src > dest ? src : dest;
+		if (self->size >= pos && count > self->size - pos) {
 			PyErr_SetString(PyExc_ValueError,
 					"source or destination out of range");
 			return NULL;
