Fix #8105. Add validation to mmap.mmap so invalid file descriptors

don't cause a crash on Windows.

3 files changed, 19 insertions, 1 deletions

diff --git a/Lib/test/test_mmap.py b/Lib/test/test_mmap.py
index 68af00e..5906c02 100644
--- a/Lib/test/test_mmap.py
+++ b/Lib/test/test_mmap.py
@@ -1,6 +1,6 @@
 from test.support import TESTFN, run_unittest, import_module
 import unittest
-import os, re, itertools
+import os, re, itertools, socket
 
 # Skip test if we can't import mmap.
 mmap = import_module('mmap')
@@ -586,6 +586,17 @@ class MmapTests(unittest.TestCase):
                 pass
             m.close()
 
+        def test_invalid_descriptor(self):
+            # socket file descriptors are valid, but out of range
+            # for _get_osfhandle, causing a crash when validating the
+            # parameters to _get_osfhandle.
+            s = socket.socket()
+            try:
+                with self.assertRaises(mmap.error):
+                    m = mmap.mmap(s.fileno(), 10)
+            finally:
+                s.close()
+
     def test_context_manager(self):
         with mmap.mmap(-1, 10) as m:
             self.assertFalse(m.closed)
diff --git a/Misc/NEWS b/Misc/NEWS
index 2affe70..0fa7845 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -21,6 +21,8 @@ Core and Builtins
 Extensions
 ----------
 
+- Issue #8105: Validate file descriptor passed to mmap.mmap on Windows.
+
 - Issue #8046: Add context manager protocol support and .closed property
   to mmap objects.
 
diff --git a/Modules/mmapmodule.c b/Modules/mmapmodule.c
index de527ce..3973124 100644
--- a/Modules/mmapmodule.c
+++ b/Modules/mmapmodule.c
@@ -1236,6 +1236,11 @@ new_mmap_object(PyTypeObject *type, PyObject *args, PyObject *kwdict)
                      1);
      */
     if (fileno != -1 && fileno != 0) {
+        /* Ensure that fileno is within the CRT's valid range */
+        if (_PyVerify_fd(fileno) == 0) {
+            PyErr_SetFromErrno(mmap_module_error);
+            return NULL;
+        }
         fh = (HANDLE)_get_osfhandle(fileno);
         if (fh==(HANDLE)-1) {
             PyErr_SetFromErrno(mmap_module_error);