Merged revisions 70052 via svnmerge from

svn+ssh://pythondev@svn.python.org/python/trunk

........
  r70052 | hirokazu.yamamoto | 2009-02-28 19:31:54 +0900 | 2 lines

  Issue #5386: mmap.write_byte didn't check map size, so it could cause buffer
  overrun.
........

diff --git a/Lib/test/test_mmap.py b/Lib/test/test_mmap.py
index c06b7579ccd764b2ea73343a364765e21abc7e24..c8e52a6b0c1caba408a48b63207a18d691a4cbe2 100644 (file)
--- a/Lib/test/test_mmap.py
+++ b/Lib/test/test_mmap.py
@@ -467,6 +467,38 @@ class MmapTests(unittest.TestCase):
         self.assert_(issubclass(mmap.error, EnvironmentError))
         self.assert_("mmap.error" in str(mmap.error))
 
+    def test_io_methods(self):
+        data = "0123456789"
+        open(TESTFN, "wb").write("x"*len(data))
+        f = open(TESTFN, "r+b")
+        m = mmap.mmap(f.fileno(), len(data))
+        f.close()
+        # Test write_byte()
+        for i in xrange(len(data)):
+            self.assertEquals(m.tell(), i)
+            m.write_byte(data[i:i+1])
+            self.assertEquals(m.tell(), i+1)
+        self.assertRaises(ValueError, m.write_byte, "x")
+        self.assertEquals(m[:], data)
+        # Test read_byte()
+        m.seek(0)
+        for i in xrange(len(data)):
+            self.assertEquals(m.tell(), i)
+            self.assertEquals(m.read_byte(), data[i:i+1])
+            self.assertEquals(m.tell(), i+1)
+        self.assertRaises(ValueError, m.read_byte)
+        # Test read()
+        m.seek(3)
+        self.assertEquals(m.read(3), "345")
+        self.assertEquals(m.tell(), 6)
+        # Test write()
+        m.seek(3)
+        m.write("bar")
+        self.assertEquals(m.tell(), 6)
+        self.assertEquals(m[:], "012bar6789")
+        m.seek(8)
+        self.assertRaises(ValueError, m.write, "bar")
+
 
 def test_main():
     run_unittest(MmapTests)

diff --git a/Misc/NEWS b/Misc/NEWS
index efa19a20a57890d3e557c679e64319b7ba4c8348..3553dbc47a4a538eac9934f6acdb1ee58c36975a 100644 (file)
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -89,6 +89,9 @@ Core and Builtins
 Library
 -------
 
+- Issue #5386: mmap.write_byte didn't check map size, so it could cause buffer
+  overrun.
+
 - Issue #5292: Fixed mmap crash on its boundary access m[len(m)].
 
 - Issue #5282: Fixed mmap resize on 32bit windows and unix. When offset > 0,

diff --git a/Modules/mmapmodule.c b/Modules/mmapmodule.c
index fad60d109f8c8c304ab614e2dd1e33f1c02b95d3..8407c11b3be2ca719ff667b6a6b2d8a8b19fd2b2 100644 (file)
--- a/Modules/mmapmodule.c
+++ b/Modules/mmapmodule.c
@@ -365,10 +365,17 @@ mmap_write_byte_method(mmap_object *self,
 
        if (!is_writeable(self))
                return NULL;
-       *(self->data+self->pos) = value;
-       self->pos += 1;
-       Py_INCREF(Py_None);
-       return Py_None;
+
+       if (self->pos < self->size) {
+               *(self->data+self->pos) = value;
+               self->pos += 1;
+               Py_INCREF(Py_None);
+               return Py_None;
+       }
+       else {
+               PyErr_SetString(PyExc_ValueError, "write byte out of range");
+               return NULL;
+       }
 }
 
 static PyObject *