Issue #11391: Writing to a mmap object created with

`mmap.PROT_READ|mmap.PROT_EXEC` would segfault instead of raising a
TypeError.  Patch by Charles-François Natali.

4 files changed, 23 insertions, 5 deletions

diff --git a/Lib/test/test_mmap.py b/Lib/test/test_mmap.py
index d6addff..056b9ec 100644
--- a/Lib/test/test_mmap.py
+++ b/Lib/test/test_mmap.py
@@ -237,6 +237,14 @@ class MmapTests(unittest.TestCase):
                               prot=mmap.PROT_READ, access=mmap.ACCESS_WRITE)
             f.close()
 
+            # Try writting without PROT_WRITE
+            with open(TESTFN, "r+b") as f:
+                m = mmap.mmap(f.fileno(), mapsize, prot=~mmap.PROT_WRITE)
+                self.assertRaises(TypeError, m.write, b"abcdef")
+                self.assertRaises(TypeError, m.write_byte, 0)
+                m.close()
+
+
     def test_bad_file_desc(self):
         # Try opening a bad file descriptor...
         self.assertRaises(mmap.error, mmap.mmap, -2, 4096)
diff --git a/Misc/ACKS b/Misc/ACKS
index 2ef672e..023fe94 100644
--- a/Misc/ACKS
+++ b/Misc/ACKS
@@ -560,6 +560,7 @@ Piotr Meyer
 John Nagle
 Takahiro Nakayama
 Travers Naran
+Charles-François Natali
 Fredrik Nehr
 Trent Nelson
 Tony Nelson
diff --git a/Misc/NEWS b/Misc/NEWS
index ed3f72a..9531d90 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -37,6 +37,10 @@ Core and Builtins
 Library
 -------
 
+- Issue #11391: Writing to a mmap object created with
+  ``mmap.PROT_READ|mmap.PROT_EXEC`` would segfault instead of raising a
+  TypeError.  Patch by Charles-François Natali.
+
 - Issue #11265: asyncore now correctly handles EPIPE, EBADF and EAGAIN errors
   on accept(), send() and recv().
 
diff --git a/Modules/mmapmodule.c b/Modules/mmapmodule.c
index c8c8cb2..f484a7a 100644
--- a/Modules/mmapmodule.c
+++ b/Modules/mmapmodule.c
@@ -1075,17 +1075,22 @@ new_mmap_object(PyTypeObject *type, PyObject *args, PyObject *kwdict)
         prot = PROT_READ | PROT_WRITE;
         break;
     case ACCESS_DEFAULT:
-        /* use the specified or default values of flags and prot */
+        /* map prot to access type */
+        if ((prot & PROT_READ) && (prot & PROT_WRITE)) {
+            /* ACCESS_DEFAULT */
+        }
+        else if (prot & PROT_WRITE) {
+            access = ACCESS_WRITE;
+        }
+        else {
+            access = ACCESS_READ;
+        }
         break;
     default:
         return PyErr_Format(PyExc_ValueError,
                             "mmap invalid access parameter.");
     }
 
-    if (prot == PROT_READ) {
-    access = ACCESS_READ;
-    }
-
 #ifdef HAVE_FSTAT
 #  ifdef __VMS
     /* on OpenVMS we must ensure that all bytes are written to the file */