[issue5387] mmap.move crashes by integer overflow
Hirokazu Yamamoto
report at bugs.python.org
Tue Mar 31 15:05:42 CEST 2009
Hirokazu Yamamoto <ocean-city at m2.ccsnet.ne.jp> added the comment:
Well, I think your patch has some issues.
>>> import mmap
>>> m = mmap.mmap(-1, 10)
>>> m.move(10, 10, 0) # legal, should not fail
Traceback (most recent call last):
File "<stdin>", line 1, in <module>
ValueError: source out of range
>>> m.move(9, 9, -1) # should not crash
(crash)
I hesitated to commit my patch because mmap.move is using unsigned long,
but I thought it should use size_t or Py_ssize_t (If mmap should
represent total memory area, it may have to use size_t, but maybe it
should use Py_ssize_t as well as other python modules like string)
Anyway, I'll commit my patch before Python2.6.2 will be released. Crash
is not good thing for any time. :-)
----------
_______________________________________
Python tracker <report at bugs.python.org>
<http://bugs.python.org/issue5387>
_______________________________________
More information about the Python-bugs-list
mailing list