Merged revisions 70879 via svnmerge from

svn+ssh://pythondev@svn.python.org/python/trunk

........
  r70879 | hirokazu.yamamoto | 2009-04-01 05:14:04 +0900 | 1 line

  Issue #5387: Fixed mmap.move crash by integer overflow. (take2)
........

diff --git a/Lib/test/test_mmap.py b/Lib/test/test_mmap.py
index 2e036737722fbc37b86200f45b108278067d708e..a2e9f7242a1a20dfede1306e4953e339d7f8795c 100644 (file)
--- a/Lib/test/test_mmap.py
+++ b/Lib/test/test_mmap.py
@@ -1,7 +1,7 @@
 from test.support import TESTFN, run_unittest
 import mmap
 import unittest
-import os, re
+import os, re, itertools
 
 PAGESIZE = mmap.PAGESIZE
 
@@ -347,9 +347,21 @@ class MmapTests(unittest.TestCase):
                     self.assertEqual(m[:], expected)
                     m.close()
 
-        # should not crash
-        m = mmap.mmap(-1, 1)
-        self.assertRaises(ValueError, m.move, 1, 1, -1)
+        # segfault test (Issue 5387)
+        m = mmap.mmap(-1, 100)
+        offsets = [-100, -1, 0, 1, 100]
+        for source, dest, size in itertools.product(offsets, offsets, offsets):
+            try:
+                m.move(source, dest, size)
+            except ValueError:
+                pass
+        self.assertRaises(ValueError, m.move, -1, -1, -1)
+        self.assertRaises(ValueError, m.move, -1, -1, 0)
+        self.assertRaises(ValueError, m.move, -1, 0, -1)
+        self.assertRaises(ValueError, m.move, 0, -1, -1)
+        self.assertRaises(ValueError, m.move, -1, 0, 0)
+        self.assertRaises(ValueError, m.move, 0, -1, 0)
+        self.assertRaises(ValueError, m.move, 0, 0, -1)
         m.close()
 
     def test_anonymous(self):

diff --git a/Modules/mmapmodule.c b/Modules/mmapmodule.c
index c6c8a301826ec7ae0f5756f492b4853319b08d0d..b9c46cd919a0775c1f31bd2a4cb24f841a5adafb 100644 (file)
--- a/Modules/mmapmodule.c
+++ b/Modules/mmapmodule.c
@@ -628,7 +628,7 @@ mmap_move_method(mmap_object *self, PyObject *args)
        } else {
                /* bounds check the values */
                unsigned long pos = src > dest ? src : dest;
-               if (self->size >= pos && count > self->size - pos) {
+               if (self->size < pos || count > self->size - pos) {
                        PyErr_SetString(PyExc_ValueError,
                                        "source or destination out of range");
                        return NULL;