diff options
| author | Hirokazu Yamamoto <ocean-city@m2.ccsnet.ne.jp> | 2009-03-31 13:13:05 (GMT) |
|---|---|---|
| committer | Hirokazu Yamamoto <ocean-city@m2.ccsnet.ne.jp> | 2009-03-31 13:13:05 (GMT) |
| commit | 9d2ee5ded2ffd7e533776936ac3b34dbb782a847 (patch) | |
| tree | 7ca4669f2c152d2be0f7f2811d702f67e443b299 /Modules | |
| parent | b2898e0acb7c40c8e77f0210d564eefa4779f24a (diff) | |
| download | cpython-9d2ee5ded2ffd7e533776936ac3b34dbb782a847.zip cpython-9d2ee5ded2ffd7e533776936ac3b34dbb782a847.tar.gz cpython-9d2ee5ded2ffd7e533776936ac3b34dbb782a847.tar.bz2 | |
Issue #5387: Fixed mmap.move crash by integer overflow.
Diffstat (limited to 'Modules')
| -rw-r--r-- | Modules/mmapmodule.c | 6 |
1 files changed, 2 insertions, 4 deletions
diff --git a/Modules/mmapmodule.c b/Modules/mmapmodule.c index 95dcfbe..d191c1e 100644 --- a/Modules/mmapmodule.c +++ b/Modules/mmapmodule.c @@ -612,10 +612,8 @@ mmap_move_method(mmap_object *self, PyObject *args) return NULL; } else { /* bounds check the values */ - if (/* end of source after end of data?? */ - ((src+count) > self->size) - /* dest will fit? */ - || (dest+count > self->size)) { + unsigned long pos = src > dest ? src : dest; + if (self->size >= pos && count > self->size - pos) { PyErr_SetString(PyExc_ValueError, "source or destination out of range"); return NULL; |