Fix SF #441664: Python crash on del of a slice of a mmap

Check for slice/item deletion, which calls slice/item assignment with a NULL
value, and raise a TypeError instead of coredumping. Bugreport and suggested
fix by Alex Martelli.

diff --git a/Modules/mmapmodule.c b/Modules/mmapmodule.c
index 63ef72a7f36d8c83d418eb60db1a93b144e00108..d5bc89f309d55842a73714b6c4d729dafdd3859d 100644 (file)
--- a/Modules/mmapmodule.c
+++ b/Modules/mmapmodule.c
@@ -663,6 +663,11 @@ mmap_ass_slice(mmap_object *self, int ilow, int ihigh, PyObject *v)
        else if ((size_t)ihigh > self->size)
                ihigh = self->size;
     
+       if (v == NULL) {
+               PyErr_SetString(PyExc_TypeError,
+                       "mmap object doesn't support slice deletion");
+               return -1;
+       }
        if (! (PyString_Check(v)) ) {
                PyErr_SetString(PyExc_IndexError, 
                                "mmap slice assignment must be a string");
@@ -688,6 +693,11 @@ mmap_ass_item(mmap_object *self, int i, PyObject *v)
                PyErr_SetString(PyExc_IndexError, "mmap index out of range");
                return -1;
        }
+       if (v == NULL) {
+               PyErr_SetString(PyExc_TypeError,
+                       "mmap object doesn't support item deletion");
+               return -1;
+       }
        if (! (PyString_Check(v) && PyString_Size(v)==1) ) {
                PyErr_SetString(PyExc_IndexError, 
                        "mmap assignment must be single-character string");