diff options
| author | Richard Oudkerk <shibturn@gmail.com> | 2013-02-13 12:18:03 (GMT) |
|---|---|---|
| committer | Richard Oudkerk <shibturn@gmail.com> | 2013-02-13 12:18:03 (GMT) |
| commit | 0d09ba8e0bc57b50984d1968aab3c29de3e1320d (patch) | |
| tree | a91dea1de06d69f47b0ba922c4b46467b6f7c15a /Modules | |
| parent | 7e0191170e95ffd9c95d840a5631e0f1831998f9 (diff) | |
| download | cpython-0d09ba8e0bc57b50984d1968aab3c29de3e1320d.zip cpython-0d09ba8e0bc57b50984d1968aab3c29de3e1320d.tar.gz cpython-0d09ba8e0bc57b50984d1968aab3c29de3e1320d.tar.bz2 | |
Issue #16743: Fix mmap overflow check on 32 bit Windows
Diffstat (limited to 'Modules')
| -rw-r--r-- | Modules/mmapmodule.c | 22 |
1 files changed, 11 insertions, 11 deletions
diff --git a/Modules/mmapmodule.c b/Modules/mmapmodule.c index 33c143e..352dd52 100644 --- a/Modules/mmapmodule.c +++ b/Modules/mmapmodule.c @@ -1140,7 +1140,6 @@ new_mmap_object(PyTypeObject *type, PyObject *args, PyObject *kwdict) # endif if (fd != -1 && fstat(fd, &st) == 0 && S_ISREG(st.st_mode)) { if (map_size == 0) { - off_t calc_size; if (st.st_size == 0) { PyErr_SetString(PyExc_ValueError, "cannot mmap an empty file"); @@ -1151,13 +1150,12 @@ new_mmap_object(PyTypeObject *type, PyObject *args, PyObject *kwdict) "mmap offset is greater than file size"); return NULL; } - calc_size = st.st_size - offset; - map_size = calc_size; - if (map_size != calc_size) { + if (st.st_size - offset > PY_SSIZE_T_MAX) { PyErr_SetString(PyExc_ValueError, "mmap length is too large"); - return NULL; - } + return NULL; + } + map_size = (Py_ssize_t) (st.st_size - offset); } else if (offset + (size_t)map_size > st.st_size) { PyErr_SetString(PyExc_ValueError, "mmap length is greater than file size"); @@ -1354,11 +1352,13 @@ new_mmap_object(PyTypeObject *type, PyObject *args, PyObject *kwdict) Py_DECREF(m_obj); return NULL; } - if (offset - size > PY_SSIZE_T_MAX) - /* Map area too large to fit in memory */ - m_obj->size = (Py_ssize_t) -1; - else - m_obj->size = (Py_ssize_t) (size - offset); + if (size - offset > PY_SSIZE_T_MAX) { + PyErr_SetString(PyExc_ValueError, + "mmap length is too large"); + Py_DECREF(m_obj); + return NULL; + } + m_obj->size = (Py_ssize_t) (size - offset); } else { m_obj->size = map_size; size = offset + map_size; |