diff options
| author | Antoine Pitrou <solipsis@pitrou.net> | 2011-01-20 21:20:18 (GMT) |
|---|---|---|
| committer | Antoine Pitrou <solipsis@pitrou.net> | 2011-01-20 21:20:18 (GMT) |
| commit | 8a0eede21de65f2d96c7e533e3c2aeca60a7859a (patch) | |
| tree | babcc40240337cb8c405723104d256583b9b302c /Modules | |
| parent | 7e8fbd2b7deb51999908ab0b4f61ac254a9cf81a (diff) | |
| download | cpython-8a0eede21de65f2d96c7e533e3c2aeca60a7859a.zip cpython-8a0eede21de65f2d96c7e533e3c2aeca60a7859a.tar.gz cpython-8a0eede21de65f2d96c7e533e3c2aeca60a7859a.tar.bz2 | |
Merged revisions 88131 via svnmerge from
svn+ssh://pythondev@svn.python.org/python/branches/py3k
........
r88131 | antoine.pitrou | 2011-01-20 22:07:24 +0100 (jeu., 20 janv. 2011) | 6 lines
Issue #10955: Fix a potential crash when trying to mmap() a file past its
length. Initial patch by Ross Lagerwall.
This fixes a regression introduced by r88022.
........
Diffstat (limited to 'Modules')
| -rw-r--r-- | Modules/mmapmodule.c | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/Modules/mmapmodule.c b/Modules/mmapmodule.c index 0e91f2c..4b2a971 100644 --- a/Modules/mmapmodule.c +++ b/Modules/mmapmodule.c @@ -1164,6 +1164,11 @@ new_mmap_object(PyTypeObject *type, PyObject *args, PyObject *kwdict) # endif if (fd != -1 && fstat(fd, &st) == 0 && S_ISREG(st.st_mode)) { if (map_size == 0) { + if (offset >= st.st_size) { + PyErr_SetString(PyExc_ValueError, + "mmap offset is greater than file size"); + return NULL; + } map_size = st.st_size - offset; } else if ((size_t)offset + (size_t)map_size > st.st_size) { PyErr_SetString(PyExc_ValueError, @@ -1346,6 +1351,12 @@ new_mmap_object(PyTypeObject *type, PyObject *args, PyObject *kwdict) else m_obj->size = low; #endif + if (offset >= m_obj->size) { + PyErr_SetString(PyExc_ValueError, + "mmap offset is greater than file size"); + Py_DECREF(m_obj); + return NULL; + } m_obj->size -= offset; } else { m_obj->size = map_size; |