traverseda
/
cpython
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Merged revisions 73684 via svnmerge from 

svn+ssh://pythondev@svn.python.org/python/branches/py3k

................
  r73684 | hirokazu.yamamoto | 2009-06-29 23:54:12 +0900 | 14 lines

  Merged revisions 73677,73681 via svnmerge from
  svn+ssh://pythondev@svn.python.org/python/trunk

  ........
    r73677 | hirokazu.yamamoto | 2009-06-29 22:25:16 +0900 | 2 lines

    Issue #6344: Fixed a crash of mmap.read() when passed a negative argument.
    Reviewed by Amaury Forgeot d'Arc.
  ........
    r73681 | hirokazu.yamamoto | 2009-06-29 23:29:31 +0900 | 1 line

    Fixed NEWS.
  ........
................
This commit is contained in:
Hirokazu Yamamoto 2009-06-29 15:02:36 +00:00
parent 6870f26d26
commit 4e82f2df3d
2 changed files with 15 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Misc/NEWS
View File

@ -15,6 +15,8 @@ Core and Builtins
Library
-------
- Issue #6344: Fixed a crash of mmap.read() when passed a negative argument.
Build
-----

16
Modules/mmapmodule.c
View File

@ -238,7 +238,7 @@ static PyObject *
mmap_read_method(mmap_object *self,
PyObject *args)
{
Py_ssize_t num_bytes;
Py_ssize_t num_bytes, n;
PyObject *result;
CHECK_VALID(NULL);
@ -246,8 +246,18 @@ mmap_read_method(mmap_object *self,
return(NULL);
/* silently 'adjust' out-of-range requests */
if (num_bytes > self->size - self->pos) {
num_bytes -= (self->pos+num_bytes) - self->size;
assert(self->size >= self->pos);
n = self->size - self->pos;
/* The difference can overflow, only if self->size is greater than
* PY_SSIZE_T_MAX. But then the operation cannot possibly succeed,
* because the mapped area and the returned string each need more
* than half of the addressable memory. So we clip the size, and let
* the code below raise MemoryError.
*/
if (n < 0)
n = PY_SSIZE_T_MAX;
if (num_bytes < 0 || num_bytes > n) {
num_bytes = n;
}
result = PyBytes_FromStringAndSize(self->data+self->pos, num_bytes);
self->pos += num_bytes;