Issue #5386: mmap.write_byte didn't check map size, so it could cause buffer
overrun.
diff --git a/Lib/test/test_mmap.py b/Lib/test/test_mmap.py
index c06b757..c8e52a6 100644
--- a/Lib/test/test_mmap.py
+++ b/Lib/test/test_mmap.py
@@ -467,6 +467,38 @@
self.assert_(issubclass(mmap.error, EnvironmentError))
self.assert_("mmap.error" in str(mmap.error))
+ def test_io_methods(self):
+ data = "0123456789"
+ open(TESTFN, "wb").write("x"*len(data))
+ f = open(TESTFN, "r+b")
+ m = mmap.mmap(f.fileno(), len(data))
+ f.close()
+ # Test write_byte()
+ for i in xrange(len(data)):
+ self.assertEquals(m.tell(), i)
+ m.write_byte(data[i:i+1])
+ self.assertEquals(m.tell(), i+1)
+ self.assertRaises(ValueError, m.write_byte, "x")
+ self.assertEquals(m[:], data)
+ # Test read_byte()
+ m.seek(0)
+ for i in xrange(len(data)):
+ self.assertEquals(m.tell(), i)
+ self.assertEquals(m.read_byte(), data[i:i+1])
+ self.assertEquals(m.tell(), i+1)
+ self.assertRaises(ValueError, m.read_byte)
+ # Test read()
+ m.seek(3)
+ self.assertEquals(m.read(3), "345")
+ self.assertEquals(m.tell(), 6)
+ # Test write()
+ m.seek(3)
+ m.write("bar")
+ self.assertEquals(m.tell(), 6)
+ self.assertEquals(m[:], "012bar6789")
+ m.seek(8)
+ self.assertRaises(ValueError, m.write, "bar")
+
def test_main():
run_unittest(MmapTests)
diff --git a/Misc/NEWS b/Misc/NEWS
index 04421f1..0ced972 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -166,6 +166,9 @@
Library
-------
+- Issue #5386: mmap.write_byte didn't check map size, so it could cause buffer
+ overrun.
+
- Issue #1533164: Installed but not listed *.pyo was breaking Distutils
bdist_rpm command.
diff --git a/Modules/mmapmodule.c b/Modules/mmapmodule.c
index fad60d1..8407c11 100644
--- a/Modules/mmapmodule.c
+++ b/Modules/mmapmodule.c
@@ -365,10 +365,17 @@
if (!is_writeable(self))
return NULL;
- *(self->data+self->pos) = value;
- self->pos += 1;
- Py_INCREF(Py_None);
- return Py_None;
+
+ if (self->pos < self->size) {
+ *(self->data+self->pos) = value;
+ self->pos += 1;
+ Py_INCREF(Py_None);
+ return Py_None;
+ }
+ else {
+ PyErr_SetString(PyExc_ValueError, "write byte out of range");
+ return NULL;
+ }
}
static PyObject *