Issue #16743: Fix mmap overflow check on 32 bit Windows
diff --git a/Modules/mmapmodule.c b/Modules/mmapmodule.c
index 33c143e..352dd52 100644
--- a/Modules/mmapmodule.c
+++ b/Modules/mmapmodule.c
@@ -1140,7 +1140,6 @@
# endif
if (fd != -1 && fstat(fd, &st) == 0 && S_ISREG(st.st_mode)) {
if (map_size == 0) {
- off_t calc_size;
if (st.st_size == 0) {
PyErr_SetString(PyExc_ValueError,
"cannot mmap an empty file");
@@ -1151,13 +1150,12 @@
"mmap offset is greater than file size");
return NULL;
}
- calc_size = st.st_size - offset;
- map_size = calc_size;
- if (map_size != calc_size) {
+ if (st.st_size - offset > PY_SSIZE_T_MAX) {
PyErr_SetString(PyExc_ValueError,
"mmap length is too large");
- return NULL;
- }
+ return NULL;
+ }
+ map_size = (Py_ssize_t) (st.st_size - offset);
} else if (offset + (size_t)map_size > st.st_size) {
PyErr_SetString(PyExc_ValueError,
"mmap length is greater than file size");
@@ -1354,11 +1352,13 @@
Py_DECREF(m_obj);
return NULL;
}
- if (offset - size > PY_SSIZE_T_MAX)
- /* Map area too large to fit in memory */
- m_obj->size = (Py_ssize_t) -1;
- else
- m_obj->size = (Py_ssize_t) (size - offset);
+ if (size - offset > PY_SSIZE_T_MAX) {
+ PyErr_SetString(PyExc_ValueError,
+ "mmap length is too large");
+ Py_DECREF(m_obj);
+ return NULL;
+ }
+ m_obj->size = (Py_ssize_t) (size - offset);
} else {
m_obj->size = map_size;
size = offset + map_size;