From: Martin v. Löwis <martin@v.loewis.de>
Date: Fri, 23 May 2008 14:30:44 +0000 (+0000)
Subject: Patch #2111: Avoid mmap segfault when modifying a PROT_READ block.
X-Git-Tag: v2.5.3c1~94
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=5212da1b9682fc458f699d279440d5f219605c39;p=python

Patch #2111: Avoid mmap segfault when modifying a PROT_READ block.
---

diff --git a/Lib/test/test_mmap.py b/Lib/test/test_mmap.py
index d2a24770cf..2fe0211f63 100644
--- a/Lib/test/test_mmap.py
+++ b/Lib/test/test_mmap.py
@@ -380,6 +380,23 @@ def test_both():
     finally:
         os.unlink(TESTFN)
 
+    # Test that setting access to PROT_READ gives exception
+    # rather than crashing
+    if hasattr(mmap, "PROT_READ"):
+        try:
+            mapsize = 10
+            open(TESTFN, "wb").write("a"*mapsize)
+            f = open(TESTFN, "rb")
+            m = mmap.mmap(f.fileno(), mapsize, prot=mmap.PROT_READ)
+            try:
+                m.write("foo")
+            except TypeError:
+                pass
+            else:
+                verify(0, "PROT_READ is not working")
+        finally:
+            os.unlink(TESTFN)
+
 def test_anon():
     print "  anonymous mmap.mmap(-1, PAGESIZE)..."
     m = mmap.mmap(-1, PAGESIZE)
diff --git a/Misc/NEWS b/Misc/NEWS
index f7d732717c..2a60b051cb 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -86,6 +86,8 @@ Library
 Extension Modules
 -----------------
 
+- Patch #2111: Avoid mmap segfault when modifying a PROT_READ block.
+
 - zlib.decompressobj().flush(value) no longer crashes the interpreter when
   passed a value less than or equal to zero.
 
diff --git a/Modules/mmapmodule.c b/Modules/mmapmodule.c
index 091ecd6e1c..3565ab6add 100644
--- a/Modules/mmapmodule.c
+++ b/Modules/mmapmodule.c
@@ -881,6 +881,10 @@ new_mmap_object(PyObject *self, PyObject *args, PyObject *kwdict)
 				    "mmap invalid access parameter.");
 	}
 
+    if (prot == PROT_READ) {
+        access = ACCESS_READ;
+    }
+
 #ifdef HAVE_FSTAT
 #  ifdef __VMS
 	/* on OpenVMS we must ensure that all bytes are written to the file */