[Patches] Fix for readline() method of mmap objects

Hrvoje Niksic hniksic@iskon.hr
04 Apr 2000 20:11:32 +0200


I'm glad that mmapmodule.c made it into Python 1.6.  Some time ago
I've found a bug in it, and it's still there.

The bug is in mmap_read_line_method(), and its loop that searches for
newlines.  After the loop reaches EOF, eol is incremented and points
after the end of the memory.  This results in readline() method
sometimes picking up and returning a byte after the end of the string.
This is usually a bogus \0, but it could cause SIGSEGV if it's after
the end of the page).

The patch fixes the problem.  Also, it uses memchr() for finding a
character, which is in fact the "strnchr" the comment is asking for.
memchr() is already used in Python sources, so there should be no
portability problems.

*** Modules/mmapmodule.c.old	Tue Apr  4 15:57:07 2000
--- Modules/mmapmodule.c	Tue Apr  4 15:57:40 2000
***************
*** 132,151 ****
  mmap_read_line_method (mmap_object * self,
  			   PyObject * args)
  {
! 	char * start;
  	char * eof = self->data+self->size;
  	char * eol;
  	PyObject * result;
  
  	CHECK_VALID(NULL);
- 	start = self->data+self->pos;
  
! 	/* strchr was a bad idea here - there's no way to range
! 	   check it.  there is no 'strnchr' */
! 	for (eol = start; (eol < eof) && (*eol != '\n') ; eol++)
! 	{ /* do nothing */ }
! 
! 	result = Py_BuildValue("s#", start, (long) (++eol - start));
  	self->pos += (eol - start);
  	return (result);
  }
--- 132,151 ----
  mmap_read_line_method (mmap_object * self,
  			   PyObject * args)
  {
! 	char * start = self->data+self->pos;
  	char * eof = self->data+self->size;
  	char * eol;
  	PyObject * result;
  
  	CHECK_VALID(NULL);
  
! 	eol = memchr(start, '\n', self->size - self->pos);
! 	if (!eol)
! 		eol = eof;
! 	else
! 		++eol;		/* we're interested in the position after the
! 				   newline. */
! 	result = PyString_FromStringAndSize(start, (long) (eol - start));
  	self->pos += (eol - start);
  	return (result);
  }


I confirm that, to the best of my knowledge and belief, this
contribution is free of any claims of third parties under
copyright, patent or other rights or interests ("claims").  To
the extent that I have any such claims, I hereby grant to CNRI a
nonexclusive, irrevocable, royalty-free, worldwide license to
reproduce, distribute, perform and/or display publicly, prepare
derivative versions, and otherwise use this contribution as part
of the Python software and its related documentation, or any
derivative versions thereof, at no cost to CNRI or its licensed
users, and to authorize others to do so.

I acknowledge that CNRI may, at its sole discretion, decide
whether or not to incorporate this contribution in the Python
software and its related documentation.  I further grant CNRI
permission to use my name and other identifying information
provided to CNRI by me for use in connection with the Python
software and its related documentation.