Merged revisions 70056 via svnmerge from

svn+ssh://pythondev@svn.python.org/python/trunk

........
  r70056 | hirokazu.yamamoto | 2009-02-28 21:13:07 +0900 | 2 lines

  Issue #1733986: Fixed mmap crash in accessing elements of second map object
  with same tagname but larger size than first map. (Windows)
........

Lib/test/test_mmap.py

@@ -499,6 +499,34 @@ class MmapTests(unittest.TestCase):
         m.seek(8)
         self.assertRaises(ValueError, m.write, "bar")
 
+    if os.name == 'nt':
+        def test_tagname(self):
+            data1 = "0123456789"
+            data2 = "abcdefghij"
+            assert len(data1) == len(data2)
+            # Test same tag
+            m1 = mmap.mmap(-1, len(data1), tagname="foo")
+            m1[:] = data1
+            m2 = mmap.mmap(-1, len(data2), tagname="foo")
+            m2[:] = data2
+            self.assertEquals(m1[:], data2)
+            self.assertEquals(m2[:], data2)
+            # Test differnt tag
+            m1 = mmap.mmap(-1, len(data1), tagname="foo")
+            m1[:] = data1
+            m2 = mmap.mmap(-1, len(data2), tagname="boo")
+            m2[:] = data2
+            self.assertEquals(m1[:], data1)
+            self.assertEquals(m2[:], data2)
+
+        def test_tagname_crash(self):
+            # Should not crash (Issue 1733986)
+            m = mmap.mmap(-1, 1000, tagname="foo")
+            try:
+                mmap.mmap(-1, 5000, tagname="foo")[:] # same tagname, but larger size
+            except:
+                pass
+
 
 def test_main():
     run_unittest(MmapTests)

Misc/NEWS

@@ -89,6 +89,9 @@ Core and Builtins
 Library
 -------
 
+- Issue #1733986: Fixed mmap crash in accessing elements of second map object
+  with same tagname but larger size than first map. (Windows)
+
 - Issue #5386: mmap.write_byte didn't check map size, so it could cause buffer
   overrun.
 

Modules/mmapmodule.c

@@ -1373,7 +1373,7 @@ new_mmap_object(PyTypeObject *type, PyObject *args, PyObject *kwdict)
 						     dwDesiredAccess,
 						     off_hi,
 						     off_lo,
-						     0);
+						     m_obj->size);
 		if (m_obj->data != NULL)
 			return (PyObject *)m_obj;
 		else