diff options
| author | Hirokazu Yamamoto <ocean-city@m2.ccsnet.ne.jp> | 2009-03-31 13:44:06 (GMT) |
|---|---|---|
| committer | Hirokazu Yamamoto <ocean-city@m2.ccsnet.ne.jp> | 2009-03-31 13:44:06 (GMT) |
| commit | 16caab00a259c1a01f8e47abdd321c42b1b6e554 (patch) | |
| tree | 3f0b25ec6a9f8f9cd9e5cd5f852b46418fc280bd /Modules/mmapmodule.c | |
| parent | 6bf6367b6725dd6fd2d7d07a447117d72b31c40e (diff) | |
| download | cpython-16caab00a259c1a01f8e47abdd321c42b1b6e554.zip cpython-16caab00a259c1a01f8e47abdd321c42b1b6e554.tar.gz cpython-16caab00a259c1a01f8e47abdd321c42b1b6e554.tar.bz2 | |
Merged revisions 70800 via svnmerge from
svn+ssh://pythondev@svn.python.org/python/trunk
........
r70800 | hirokazu.yamamoto | 2009-03-31 22:13:05 +0900 | 1 line
Issue #5387: Fixed mmap.move crash by integer overflow.
........
Diffstat (limited to 'Modules/mmapmodule.c')
| -rw-r--r-- | Modules/mmapmodule.c | 6 |
1 files changed, 2 insertions, 4 deletions
diff --git a/Modules/mmapmodule.c b/Modules/mmapmodule.c index 45da96f..d903eca 100644 --- a/Modules/mmapmodule.c +++ b/Modules/mmapmodule.c @@ -623,10 +623,8 @@ mmap_move_method(mmap_object *self, PyObject *args) return NULL; } else { /* bounds check the values */ - if (/* end of source after end of data?? */ - ((src+count) > self->size) - /* dest will fit? */ - || (dest+count > self->size)) { + unsigned long pos = src > dest ? src : dest; + if (self->size >= pos && count > self->size - pos) { PyErr_SetString(PyExc_ValueError, "source or destination out of range"); return NULL; |