Issue #6629: Fix a data corruption issue in the new `io` package, which could

occur when writing to a BufferedRandom object (e.g. a file opened in "rb+" or
"wb+" mode) after having buffered a certain amount of data for reading. This
bug was not present in the pure Python implementation.

Yes, this is a serious issue.

1 files changed, 13 insertions, 0 deletions

diff --git a/Modules/_io/bufferedio.c b/Modules/_io/bufferedio.c
index 554e113..6e5e0fa 100644
--- a/Modules/_io/bufferedio.c
+++ b/Modules/_io/bufferedio.c
@@ -1774,6 +1774,19 @@ bufferedwriter_write(buffered *self, PyObject *args)
     }
     Py_CLEAR(res);
 
+    /* Adjust the raw stream position if it is away from the logical stream
+       position. This happens if the read buffer has been filled but not
+       modified (and therefore _bufferedwriter_flush_unlocked() didn't rewind
+       the raw stream by itself).
+       Fixes issue #6629.
+    */
+    n = RAW_OFFSET(self);
+    if (n != 0) {
+        if (_buffered_raw_seek(self, -n, 1) < 0)
+            goto error;
+        self->raw_pos -= n;
+    }
+
     /* Then write buf itself. At this point the buffer has been emptied. */
     remaining = buf.len;
     written = 0;