mirrors
/
cpython
mirror of https://github.com/python/cpython.git
2
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

bounds check arguments to mmap.move(). All of them. Really. 

fixes crasher on OS X 10.5
This commit is contained in:
Jack Diederich 2009-04-01 20:26:13 +00:00
parent ce3d221447
commit 2ecd3c36b5
2 changed files with 23 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
Lib/test/test_mmap.py
View File

@ -359,15 +359,22 @@ def test_move(self):
m.move(source, dest, size) m.move(source, dest, size)
except ValueError: except ValueError:
pass pass
self.assertRaises(ValueError, m.move, -1, -1, -1)
self.assertRaises(ValueError, m.move, -1, -1, 0) offsets = [(-1, -1, -1), (-1, -1, 0), (-1, 0, -1), (0, -1, -1),
self.assertRaises(ValueError, m.move, -1, 0, -1) (-1, 0, 0), (0, -1, 0), (0, 0, -1)]
self.assertRaises(ValueError, m.move, 0, -1, -1) for source, dest, size in offsets:
self.assertRaises(ValueError, m.move, -1, 0, 0) self.assertRaises(ValueError, m.move, source, dest, size)
self.assertRaises(ValueError, m.move, 0, -1, 0)
self.assertRaises(ValueError, m.move, 0, 0, -1)
m.close() m.close()
m = mmap.mmap(-1, 1) # single byte
self.assertRaises(ValueError, m.move, 0, 0, 2)
self.assertRaises(ValueError, m.move, 1, 0, 1)
self.assertRaises(ValueError, m.move, 0, 1, 1)
m.move(0, 0, 1)
m.move(0, 0, 0)
def test_anonymous(self): def test_anonymous(self):
# anonymous mmap.mmap(-1, PAGE) # anonymous mmap.mmap(-1, PAGE)
m = mmap.mmap(-1, PAGESIZE) m = mmap.mmap(-1, PAGESIZE)

16
Modules/mmapmodule.c
View File

@ -609,24 +609,24 @@ mmap_seek_method(mmap_object *self, PyObject *args)
static PyObject * static PyObject *
mmap_move_method(mmap_object *self, PyObject *args) mmap_move_method(mmap_object *self, PyObject *args)
{ {
unsigned long dest, src, count; unsigned long dest, src, cnt;
CHECK_VALID(NULL); CHECK_VALID(NULL);
if (!PyArg_ParseTuple(args, "kkk:move", &dest, &src, &count) || if (!PyArg_ParseTuple(args, "kkk:move", &dest, &src, &cnt) ||
!is_writeable(self)) { !is_writeable(self)) {
return NULL; return NULL;
} else { } else {
/* bounds check the values */ /* bounds check the values */
unsigned long pos = src > dest ? src : dest; if (cnt < 0 || (cnt + dest) < cnt || (cnt + src) < cnt ||
if (self->size < pos || count > self->size - pos) { src < 0 || src > self->size || (src + cnt) > self->size ||
dest < 0 || dest > self->size || (dest + cnt) > self->size) {
PyErr_SetString(PyExc_ValueError, PyErr_SetString(PyExc_ValueError,
"source or destination out of range"); "source, destination, or count out of range");
return NULL; return NULL;
} else { }
memmove(self->data+dest, self->data+src, count); memmove(self->data+dest, self->data+src, cnt);
Py_INCREF(Py_None); Py_INCREF(Py_None);
return Py_None; return Py_None;
} }
}
} }
static struct PyMethodDef mmap_object_methods[] = { static struct PyMethodDef mmap_object_methods[] = {