diff options
| author | Hirokazu Yamamoto <ocean-city@m2.ccsnet.ne.jp> | 2009-02-28 10:31:54 (GMT) |
|---|---|---|
| committer | Hirokazu Yamamoto <ocean-city@m2.ccsnet.ne.jp> | 2009-02-28 10:31:54 (GMT) |
| commit | f2dc885780278246d1a4572c822c4387142a84df (patch) | |
| tree | ec5d9d135bb0fcaa050665b98508c26186c0d362 /Modules | |
| parent | 7334735ee17951e4ee5555e1183ae4f269fe04af (diff) | |
| download | cpython-f2dc885780278246d1a4572c822c4387142a84df.zip cpython-f2dc885780278246d1a4572c822c4387142a84df.tar.gz cpython-f2dc885780278246d1a4572c822c4387142a84df.tar.bz2 | |
Issue #5386: mmap.write_byte didn't check map size, so it could cause buffer
overrun.
Diffstat (limited to 'Modules')
| -rw-r--r-- | Modules/mmapmodule.c | 15 |
1 files changed, 11 insertions, 4 deletions
diff --git a/Modules/mmapmodule.c b/Modules/mmapmodule.c index fad60d1..8407c11 100644 --- a/Modules/mmapmodule.c +++ b/Modules/mmapmodule.c @@ -365,10 +365,17 @@ mmap_write_byte_method(mmap_object *self, if (!is_writeable(self)) return NULL; - *(self->data+self->pos) = value; - self->pos += 1; - Py_INCREF(Py_None); - return Py_None; + + if (self->pos < self->size) { + *(self->data+self->pos) = value; + self->pos += 1; + Py_INCREF(Py_None); + return Py_None; + } + else { + PyErr_SetString(PyExc_ValueError, "write byte out of range"); + return NULL; + } } static PyObject * |