diff options
| author | Hirokazu Yamamoto <ocean-city@m2.ccsnet.ne.jp> | 2009-02-28 12:13:07 (GMT) |
|---|---|---|
| committer | Hirokazu Yamamoto <ocean-city@m2.ccsnet.ne.jp> | 2009-02-28 12:13:07 (GMT) |
| commit | b0e10c760c8b7907aee3253054f5ac65fe1b1d12 (patch) | |
| tree | a9b6629c7ad72d3451ef577508d08be69c3515cc | |
| parent | f2dc885780278246d1a4572c822c4387142a84df (diff) | |
| download | cpython-b0e10c760c8b7907aee3253054f5ac65fe1b1d12.zip cpython-b0e10c760c8b7907aee3253054f5ac65fe1b1d12.tar.gz cpython-b0e10c760c8b7907aee3253054f5ac65fe1b1d12.tar.bz2 | |
Issue #1733986: Fixed mmap crash in accessing elements of second map object
with same tagname but larger size than first map. (Windows)
| -rw-r--r-- | Lib/test/test_mmap.py | 28 | ||||
| -rw-r--r-- | Misc/NEWS | 3 | ||||
| -rw-r--r-- | Modules/mmapmodule.c | 2 |
3 files changed, 32 insertions, 1 deletions
diff --git a/Lib/test/test_mmap.py b/Lib/test/test_mmap.py index c8e52a6..1ad611d 100644 --- a/Lib/test/test_mmap.py +++ b/Lib/test/test_mmap.py @@ -499,6 +499,34 @@ class MmapTests(unittest.TestCase): m.seek(8) self.assertRaises(ValueError, m.write, "bar") + if os.name == 'nt': + def test_tagname(self): + data1 = "0123456789" + data2 = "abcdefghij" + assert len(data1) == len(data2) + # Test same tag + m1 = mmap.mmap(-1, len(data1), tagname="foo") + m1[:] = data1 + m2 = mmap.mmap(-1, len(data2), tagname="foo") + m2[:] = data2 + self.assertEquals(m1[:], data2) + self.assertEquals(m2[:], data2) + # Test differnt tag + m1 = mmap.mmap(-1, len(data1), tagname="foo") + m1[:] = data1 + m2 = mmap.mmap(-1, len(data2), tagname="boo") + m2[:] = data2 + self.assertEquals(m1[:], data1) + self.assertEquals(m2[:], data2) + + def test_tagname_crash(self): + # Should not crash (Issue 1733986) + m = mmap.mmap(-1, 1000, tagname="foo") + try: + mmap.mmap(-1, 5000, tagname="foo")[:] # same tagname, but larger size + except: + pass + def test_main(): run_unittest(MmapTests) @@ -166,6 +166,9 @@ Core and Builtins Library ------- +- Issue #1733986: Fixed mmap crash in accessing elements of second map object + with same tagname but larger size than first map. (Windows) + - Issue #5386: mmap.write_byte didn't check map size, so it could cause buffer overrun. diff --git a/Modules/mmapmodule.c b/Modules/mmapmodule.c index 8407c11..ca5fa88 100644 --- a/Modules/mmapmodule.c +++ b/Modules/mmapmodule.c @@ -1373,7 +1373,7 @@ new_mmap_object(PyTypeObject *type, PyObject *args, PyObject *kwdict) dwDesiredAccess, off_hi, off_lo, - 0); + m_obj->size); if (m_obj->data != NULL) return (PyObject *)m_obj; else |