Merged revisions 88097 via svnmerge from
svn+ssh://pythondev@svn.python.org/python/branches/py3k
........
r88097 | antoine.pitrou | 2011-01-18 19:57:52 +0100 (mar., 18 janv. 2011) | 4 lines
Issue #10451: memoryview objects could allow to mutate a readable buffer.
Initial patch by Ross Lagerwall.
........
diff --git a/Lib/test/test_memoryview.py b/Lib/test/test_memoryview.py
index 61e60fb..525ddea 100644
--- a/Lib/test/test_memoryview.py
+++ b/Lib/test/test_memoryview.py
@@ -9,6 +9,7 @@
import weakref
import array
from test import test_support
+import io
class AbstractMemoryTests:
@@ -230,6 +231,16 @@
gc.collect()
self.assertTrue(wr() is None, wr())
+ def test_writable_readonly(self):
+ # Issue #10451: memoryview incorrectly exposes a readonly
+ # buffer as writable causing a segfault if using mmap
+ tp = self.ro_type
+ if tp is None:
+ return
+ b = tp(self._source)
+ m = self._view(b)
+ i = io.BytesIO(b'ZZZZ')
+ self.assertRaises(TypeError, i.readinto, m)
# Variations on source objects for the buffer: bytes-like objects, then arrays
# with itemsize > 1.
diff --git a/Misc/NEWS b/Misc/NEWS
index 01412c7..dcfaece 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -9,6 +9,9 @@
Core and Builtins
-----------------
+- Issue #10451: memoryview objects could allow to mutate a readable buffer.
+ Initial patch by Ross Lagerwall.
+
- Issue #10892: Don't segfault when trying to delete __abstractmethods__ from a
class.
diff --git a/Objects/memoryobject.c b/Objects/memoryobject.c
index 4997fcc..2bac266 100644
--- a/Objects/memoryobject.c
+++ b/Objects/memoryobject.c
@@ -34,9 +34,6 @@
memory_getbuf(PyMemoryViewObject *self, Py_buffer *view, int flags)
{
int res = 0;
- /* XXX for whatever reason fixing the flags seems necessary */
- if (self->view.readonly)
- flags &= ~PyBUF_WRITABLE;
if (self->view.obj != NULL)
res = PyObject_GetBuffer(self->view.obj, view, flags);
if (view)
@@ -411,7 +408,7 @@
Py_buffer view;
PyObject *res;
- if (PyObject_GetBuffer((PyObject *)self, &view, PyBUF_FULL) < 0)
+ if (PyObject_GetBuffer((PyObject *)self, &view, PyBUF_SIMPLE) < 0)
return NULL;
res = PyBytes_FromStringAndSize(NULL, view.len);