Fix SF bug #1402308, segfault when using mmap(-1, ...)

This didn't crash on Linux, but valgrind complained.
I'm not sure if this test is valid on Windows.

Will backport.

diff --git a/Lib/test/output/test_mmap b/Lib/test/output/test_mmap
index 02b24bc358fec88167ac31207ff2246415c9af9c..1ce49436ab76690a7577bbde6f38d26ec4e71d6b 100644 (file)
--- a/Lib/test/output/test_mmap
+++ b/Lib/test/output/test_mmap
@@ -31,6 +31,7 @@ test_mmap
   Modifying copy-on-write memory map.
   Ensuring copy-on-write maps cannot be resized.
   Ensuring invalid access parameter raises exception.
+  Try opening a bad file descriptor...
   Ensuring that passing 0 as map length sets map size to current file size.
   Ensuring that passing 0 as map length sets map size to current file size.
  Test passed

diff --git a/Lib/test/test_mmap.py b/Lib/test/test_mmap.py
index 849f1707959d832c37db768c8cff70dd0d6c50f1..693031769d28c23706ff877c6a10eeaf30caff54 100644 (file)
--- a/Lib/test/test_mmap.py
+++ b/Lib/test/test_mmap.py
@@ -281,6 +281,14 @@ def test_both():
         except OSError:
             pass
 
+    print '  Try opening a bad file descriptor...'
+    try:
+        mmap.mmap(-1, 4096)
+    except mmap.error:
+        pass
+    else:
+        verify(0, 'expected a mmap.error but did not get it')
+
     # Do a tougher .find() test.  SF bug 515943 pointed out that, in 2.2,
     # searching for data with embedded \0 bytes didn't work.
     f = open(TESTFN, 'w+')

diff --git a/Misc/ACKS b/Misc/ACKS
index 42fa4098ed9402d6be424cfe5919e4b46c824952..ad77e038bda7c3d8b50b195c4d2a0530e2593e8a 100644 (file)
--- a/Misc/ACKS
+++ b/Misc/ACKS
@@ -529,6 +529,7 @@ Michael Scharf
 Neil Schemenauer
 David Scherer
 Gregor Schmid
+Ralf Schmitt
 Peter Schneider-Kamp
 Sam Schulenburg
 Stefan Schwarzer

diff --git a/Misc/NEWS b/Misc/NEWS
index d5a2361016ff294852ff25a88e42df8d04bfe5cd..6729ea8a7944da2813e4ea062d077f0c2b49c8e4 100644 (file)
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -216,6 +216,8 @@ Core and builtins
 Extension Modules
 -----------------
 
+- Bug #1402308, (possible) segfault when using mmap.mmap(-1, ...)
+
 - Bug #1400822, _curses over{lay,write} doesn't work when passing 6 ints.
   Also fix ungetmouse() which did not accept arguments properly.
   The code now conforms to the documented signature.

diff --git a/Modules/mmapmodule.c b/Modules/mmapmodule.c
index dbb3fcdde903afc7584cf167d183f37abe474c3d..2ff4494304198c9b64e881964a340074d2bac9bf 100644 (file)
--- a/Modules/mmapmodule.c
+++ b/Modules/mmapmodule.c
@@ -918,6 +918,7 @@ new_mmap_object(PyObject *self, PyObject *args, PyObject *kwdict)
 #endif
        m_obj = PyObject_New (mmap_object, &mmap_object_type);
        if (m_obj == NULL) {return NULL;}
+       m_obj->data = NULL;
        m_obj->size = (size_t) map_size;
        m_obj->pos = (size_t) 0;
        m_obj->fd = dup(fd);