Author: hirokazu.yamamoto Date: Sat Feb 28 13:13:07 2009 New Revision: 70056 Log: Issue #1733986: Fixed mmap crash in accessing elements of second map object with same tagname but larger size than first map. (Windows) Modified: python/trunk/Lib/test/test_mmap.py python/trunk/Misc/NEWS python/trunk/Modules/mmapmodule.c Modified: python/trunk/Lib/test/test_mmap.py ============================================================================== --- python/trunk/Lib/test/test_mmap.py (original) +++ python/trunk/Lib/test/test_mmap.py Sat Feb 28 13:13:07 2009 @@ -499,6 +499,34 @@ m.seek(8) self.assertRaises(ValueError, m.write, "bar") + if os.name == 'nt': + def test_tagname(self): + data1 = "0123456789" + data2 = "abcdefghij" + assert len(data1) == len(data2) + # Test same tag + m1 = mmap.mmap(-1, len(data1), tagname="foo") + m1[:] = data1 + m2 = mmap.mmap(-1, len(data2), tagname="foo") + m2[:] = data2 + self.assertEquals(m1[:], data2) + self.assertEquals(m2[:], data2) + # Test differnt tag + m1 = mmap.mmap(-1, len(data1), tagname="foo") + m1[:] = data1 + m2 = mmap.mmap(-1, len(data2), tagname="boo") + m2[:] = data2 + self.assertEquals(m1[:], data1) + self.assertEquals(m2[:], data2) + + def test_tagname_crash(self): + # Should not crash (Issue 1733986) + m = mmap.mmap(-1, 1000, tagname="foo") + try: + mmap.mmap(-1, 5000, tagname="foo")[:] # same tagname, but larger size + except: + pass + def test_main(): run_unittest(MmapTests) Modified: python/trunk/Misc/NEWS ============================================================================== --- python/trunk/Misc/NEWS (original) +++ python/trunk/Misc/NEWS Sat Feb 28 13:13:07 2009 @@ -166,6 +166,9 @@ Library ------- +- Issue #1733986: Fixed mmap crash in accessing elements of second map object + with same tagname but larger size than first map. (Windows) + - Issue #5386: mmap.write_byte didn't check map size, so it could cause buffer overrun. Modified: python/trunk/Modules/mmapmodule.c ============================================================================== --- python/trunk/Modules/mmapmodule.c (original) +++ python/trunk/Modules/mmapmodule.c Sat Feb 28 13:13:07 2009 @@ -1373,7 +1373,7 @@ dwDesiredAccess, off_hi, off_lo, - 0); + m_obj->size); if (m_obj->data != NULL) return (PyObject *)m_obj; else