[New-bugs-announce] [issue11391] mmap write segfaults if PROT_WRITE bit is not set in prot

[Charles-Francois Natali]

New submission from Charles-Francois Natali <neologix at free.fr>:

$ cat /tmp/test_mmap.py 
import mmap

m = mmap.mmap(-1, 1024, prot=mmap.PROT_READ|mmap.PROT_EXEC)
m[0] = 0
$ ./python /tmp/test_mmap.py 
Segmentation fault

When trying to perform a write, is_writable is called to check that we can indeed write to the mmaped area. is_writable just checks the access mode, and if it's not ACCESS_READ, we go ahead and proceed to the write.
The problem is that under Unix, it's possible to pass ACCESS_DEFAULT, and in that case no check is done on prot value.
In that case, is_writable will return true (since ACCESS_DEFAULT != ACCESS_READ), but if prot doesn't include PROT_WRITE bit, we'll segfault.
Attached is a patch including fix and specific test.

----------
files: mmap_check_prot_py3k.diff
keywords: patch
messages: 130008
nosy: neologix
priority: normal
severity: normal
status: open
title: mmap write segfaults if PROT_WRITE bit is not set in prot
Added file: http://bugs.python.org/file20991/mmap_check_prot_py3k.diff

_______________________________________
Python tracker <report at bugs.python.org>
<http://bugs.python.org/issue11391>
_______________________________________