Issue #1733986: Fixed mmap crash in accessing elements of second map object

with same tagname but larger size than first map. (Windows)

diff --git a/Lib/test/test_mmap.py b/Lib/test/test_mmap.py
index c8e52a6b0c1caba408a48b63207a18d691a4cbe2..1ad611d45c05eeae0a09357cd44c4af9c280b366 100644 (file)
--- a/Lib/test/test_mmap.py
+++ b/Lib/test/test_mmap.py
@@ -499,6 +499,34 @@ class MmapTests(unittest.TestCase):
         m.seek(8)
         self.assertRaises(ValueError, m.write, "bar")
 
+    if os.name == 'nt':
+        def test_tagname(self):
+            data1 = "0123456789"
+            data2 = "abcdefghij"
+            assert len(data1) == len(data2)
+            # Test same tag
+            m1 = mmap.mmap(-1, len(data1), tagname="foo")
+            m1[:] = data1
+            m2 = mmap.mmap(-1, len(data2), tagname="foo")
+            m2[:] = data2
+            self.assertEquals(m1[:], data2)
+            self.assertEquals(m2[:], data2)
+            # Test differnt tag
+            m1 = mmap.mmap(-1, len(data1), tagname="foo")
+            m1[:] = data1
+            m2 = mmap.mmap(-1, len(data2), tagname="boo")
+            m2[:] = data2
+            self.assertEquals(m1[:], data1)
+            self.assertEquals(m2[:], data2)
+
+        def test_tagname_crash(self):
+            # Should not crash (Issue 1733986)
+            m = mmap.mmap(-1, 1000, tagname="foo")
+            try:
+                mmap.mmap(-1, 5000, tagname="foo")[:] # same tagname, but larger size
+            except:
+                pass
+
 
 def test_main():
     run_unittest(MmapTests)

diff --git a/Misc/NEWS b/Misc/NEWS
index 0ced9729e47a69c65904bc6ef5d22af4b0bf057f..36567f73d5efff921c9025d557d74c719e6e8c21 100644 (file)
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -166,6 +166,9 @@ Core and Builtins
 Library
 -------
 
+- Issue #1733986: Fixed mmap crash in accessing elements of second map object
+  with same tagname but larger size than first map. (Windows)
+
 - Issue #5386: mmap.write_byte didn't check map size, so it could cause buffer
   overrun.
 

diff --git a/Modules/mmapmodule.c b/Modules/mmapmodule.c
index 8407c11b3be2ca719ff667b6a6b2d8a8b19fd2b2..ca5fa880dd254979e985765776e52ffa9dd22e3a 100644 (file)
--- a/Modules/mmapmodule.c
+++ b/Modules/mmapmodule.c
@@ -1373,7 +1373,7 @@ new_mmap_object(PyTypeObject *type, PyObject *args, PyObject *kwdict)
                                                     dwDesiredAccess,
                                                     off_hi,
                                                     off_lo,
-                                                    0);
+                                                    m_obj->size);
                if (m_obj->data != NULL)
                        return (PyObject *)m_obj;
                else