
Author: hirokazu.yamamoto Date: Tue Mar 31 22:14:04 2009 New Revision: 70879 Log: Issue #5387: Fixed mmap.move crash by integer overflow. (take2) Modified: python/trunk/Lib/test/test_mmap.py python/trunk/Modules/mmapmodule.c Modified: python/trunk/Lib/test/test_mmap.py ============================================================================== --- python/trunk/Lib/test/test_mmap.py (original) +++ python/trunk/Lib/test/test_mmap.py Tue Mar 31 22:14:04 2009 @@ -1,6 +1,6 @@ from test.test_support import TESTFN, run_unittest, import_module import unittest -import os, re +import os, re, itertools mmap = import_module('mmap') @@ -351,9 +351,21 @@ self.assertEqual(m[:], expected) m.close() - # should not crash - m = mmap.mmap(-1, 1) - self.assertRaises(ValueError, m.move, 1, 1, -1) + # segfault test (Issue 5387) + m = mmap.mmap(-1, 100) + offsets = [-100, -1, 0, 1, 100] + for source, dest, size in itertools.product(offsets, offsets, offsets): + try: + m.move(source, dest, size) + except ValueError: + pass + self.assertRaises(ValueError, m.move, -1, -1, -1) + self.assertRaises(ValueError, m.move, -1, -1, 0) + self.assertRaises(ValueError, m.move, -1, 0, -1) + self.assertRaises(ValueError, m.move, 0, -1, -1) + self.assertRaises(ValueError, m.move, -1, 0, 0) + self.assertRaises(ValueError, m.move, 0, -1, 0) + self.assertRaises(ValueError, m.move, 0, 0, -1) m.close() def test_anonymous(self): Modified: python/trunk/Modules/mmapmodule.c ============================================================================== --- python/trunk/Modules/mmapmodule.c (original) +++ python/trunk/Modules/mmapmodule.c Tue Mar 31 22:14:04 2009 @@ -617,7 +617,7 @@ } else { /* bounds check the values */ unsigned long pos = src > dest ? src : dest; - if (self->size >= pos && count > self->size - pos) { + if (self->size < pos || count > self->size - pos) { PyErr_SetString(PyExc_ValueError, "source or destination out of range"); return NULL;