Segv in mmap.move()
tjreedy at udel.edu
Thu Jul 24 00:31:11 CEST 2008
magnus.lycka at gmail.com wrote:
> Does anyone recognize this little Python crasher?
> I'll file a bug report unless someone notices it as an already
> documented bug. I found some open mmap bugs, but it wasn't
> obvious to me that this problem was one of those...
> Python 2.5.2 (r252:60911, Apr 21 2008, 11:12:42)
> [GCC 4.2.3 (Ubuntu 4.2.3-2ubuntu7)] on linux2
> Type "help", "copyright", "credits" or "license" for more information.
>>>> import mmap
>>>> data = mmap.mmap(-1, 1)
> Segmenteringsfel (core dumped)
> I first noticed the problem under Windows in 2.5.1.
On WinXP Py3.0b2, I see two bugs here.
1. For a length 1 sequence, the only offsets allowed should be 0.
However, I can index to what I suspect is a null terminator byte at
offset len(seq). This should be internally accessible only just as for
regular strings and bytes (which also have null terminators, I believe).
Indexing any farther past what should be the end gives the IndexError
I expected when indexing just past the end. (Slicing and iterating,
however, work correctly.)
>>> import mmap
>>> d, d,d
(97, 101, 0)
2. Running your code, or d.move(1,2,-1), I get python.exe 'encountered a
problem ...shutting down ... Send report?' (yes) and window closed.
Running IDLE, same msg, but after send report, IDLE shell restarted. Cute.
Modules/mmapmodule.c - mmap_move_method declares count as unsigned.
Further experimentation shows that the problem is telling it to move
exactly -1 bytes, which I am sure gets translated to 2**32-1 = 4294967295 by
PyArg_ParseTuple(args, "kkk:move", &dest, &src, &count)
Passing 2**32-1 also crashes, while 2*32-2 and other bad values give
Traceback (most recent call last):
File "<pyshell#51>", line 1, in <module>
ValueError: source or destination out of range
I suspect the 2**32-1 bug is in C memmove, perhap inherited from a
I think either a)the docs should warn that a count of -1== 4294967295
(on 32bit machines) and just that may crash the interpreter or b) the
wrapper of the underlying C function should raise ValueError for -1
also. The goal of 'no crashes' suggests the latter if sensibly possible.
Terry Jan Reedy
More information about the Python-list