Merged revisions 70800 via svnmerge from

svn+ssh://pythondev@svn.python.org/python/trunk

........
  r70800 | hirokazu.yamamoto | 2009-03-31 22:13:05 +0900 | 1 line

  Issue #5387: Fixed mmap.move crash by integer overflow.
........
This commit is contained in:
Hirokazu Yamamoto 2009-03-31 13:22:01 +00:00
parent 61e9b35e91
commit 60098040c8
3 changed files with 21 additions and 4 deletions

View File

@ -338,6 +338,23 @@ class MmapTests(unittest.TestCase):
mf.close()
f.close()
# more excessive test
data = "0123456789"
for dest in range(len(data)):
for src in range(len(data)):
for count in range(len(data) - max(dest, src)):
expected = data[:dest] + data[src:src+count] + data[dest+count:]
m = mmap.mmap(-1, len(data))
m[:] = data
m.move(dest, src, count)
self.assertEqual(m[:], expected)
m.close()
# should not crash
m = mmap.mmap(-1, 1)
self.assertRaises(ValueError, m.move, 1, 1, -1)
m.close()
def test_anonymous(self):
# anonymous mmap.mmap(-1, PAGE)
m = mmap.mmap(-1, PAGESIZE)

View File

@ -92,6 +92,8 @@ Core and Builtins
Library
-------
- Issue #5387: Fixed mmap.move crash by integer overflow.
- Issue #5261: Patch multiprocessing's semaphore.c to support context
manager use: "with multiprocessing.Lock()" works now.

View File

@ -612,10 +612,8 @@ mmap_move_method(mmap_object *self, PyObject *args)
return NULL;
} else {
/* bounds check the values */
if (/* end of source after end of data?? */
((src+count) > self->size)
/* dest will fit? */
|| (dest+count > self->size)) {
unsigned long pos = src > dest ? src : dest;
if (self->size >= pos && count > self->size - pos) {
PyErr_SetString(PyExc_ValueError,
"source or destination out of range");
return NULL;