From 3013b16b62be7768700d685f6a68e606b5f20e5a Mon Sep 17 00:00:00 2001
From: Antoine Pitrou <solipsis@pitrou.net>
Date: Tue, 18 Jan 2011 19:06:19 +0000
Subject: [PATCH] Merged revisions 88097 via svnmerge from
 svn+ssh://pythondev@svn.python.org/python/branches/py3k

........
  r88097 | antoine.pitrou | 2011-01-18 19:57:52 +0100 (mar., 18 janv. 2011) | 4 lines

  Issue #10451: memoryview objects could allow to mutate a readable buffer.
  Initial patch by Ross Lagerwall.
........
---
 Lib/test/test_memoryview.py | 11 +++++++++++
 Misc/NEWS                   |  3 +++
 Objects/memoryobject.c      |  5 +----
 3 files changed, 15 insertions(+), 4 deletions(-)

diff --git a/Lib/test/test_memoryview.py b/Lib/test/test_memoryview.py
index 61e60fbdc93..525ddeab23d 100644
--- a/Lib/test/test_memoryview.py
+++ b/Lib/test/test_memoryview.py
@@ -9,6 +9,7 @@ import gc
 import weakref
 import array
 from test import test_support
+import io
 
 
 class AbstractMemoryTests:
@@ -230,6 +231,16 @@ class AbstractMemoryTests:
             gc.collect()
             self.assertTrue(wr() is None, wr())
 
+    def test_writable_readonly(self):
+        # Issue #10451: memoryview incorrectly exposes a readonly
+        # buffer as writable causing a segfault if using mmap
+        tp = self.ro_type
+        if tp is None:
+            return
+        b = tp(self._source)
+        m = self._view(b)
+        i = io.BytesIO(b'ZZZZ')
+        self.assertRaises(TypeError, i.readinto, m)
 
 # Variations on source objects for the buffer: bytes-like objects, then arrays
 # with itemsize > 1.
diff --git a/Misc/NEWS b/Misc/NEWS
index 01412c776bf..dcfaece24cf 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -9,6 +9,9 @@ What's New in Python 2.7.2?
 Core and Builtins
 -----------------
 
+- Issue #10451: memoryview objects could allow to mutate a readable buffer.
+  Initial patch by Ross Lagerwall.
+
 - Issue #10892: Don't segfault when trying to delete __abstractmethods__ from a
   class.
 
diff --git a/Objects/memoryobject.c b/Objects/memoryobject.c
index 4997fcc6c96..2bac266ea7f 100644
--- a/Objects/memoryobject.c
+++ b/Objects/memoryobject.c
@@ -34,9 +34,6 @@ static int
 memory_getbuf(PyMemoryViewObject *self, Py_buffer *view, int flags)
 {
     int res = 0;
-    /* XXX for whatever reason fixing the flags seems necessary */
-    if (self->view.readonly)
-        flags &= ~PyBUF_WRITABLE;
     if (self->view.obj != NULL)
         res = PyObject_GetBuffer(self->view.obj, view, flags);
     if (view)
@@ -411,7 +408,7 @@ memory_tobytes(PyMemoryViewObject *self, PyObject *noargs)
     Py_buffer view;
     PyObject *res;
 
-    if (PyObject_GetBuffer((PyObject *)self, &view, PyBUF_FULL) < 0)
+    if (PyObject_GetBuffer((PyObject *)self, &view, PyBUF_SIMPLE) < 0)
         return NULL;
 
     res = PyBytes_FromStringAndSize(NULL, view.len);