[issue5387] mmap.move crashes by integer overflow

Hirokazu Yamamoto report at bugs.python.org
Tue Mar 31 15:05:42 CEST 2009


Hirokazu Yamamoto <ocean-city at m2.ccsnet.ne.jp> added the comment:

Well, I think your patch has some issues.

>>> import mmap
>>> m = mmap.mmap(-1, 10)
>>> m.move(10, 10, 0) # legal, should not fail
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
ValueError: source out of range
>>> m.move(9, 9, -1) # should not crash
(crash)

I hesitated to commit my patch because mmap.move is using unsigned long,
but I thought it should use size_t or Py_ssize_t (If mmap should
represent total memory area, it may have to use size_t, but maybe it
should use Py_ssize_t as well as other python modules like string)

Anyway, I'll commit my patch before Python2.6.2 will be released. Crash
is not good thing for any time. :-)

----------

_______________________________________
Python tracker <report at bugs.python.org>
<http://bugs.python.org/issue5387>
_______________________________________


More information about the Python-bugs-list mailing list