Issue #5387: Fixed mmap.move crash by integer overflow. (take2)
diff --git a/Lib/test/test_mmap.py b/Lib/test/test_mmap.py
index b8998ea..1a23f2e 100644
--- a/Lib/test/test_mmap.py
+++ b/Lib/test/test_mmap.py
@@ -1,6 +1,6 @@
from test.test_support import TESTFN, run_unittest, import_module
import unittest
-import os, re
+import os, re, itertools
mmap = import_module('mmap')
@@ -351,9 +351,21 @@
self.assertEqual(m[:], expected)
m.close()
- # should not crash
- m = mmap.mmap(-1, 1)
- self.assertRaises(ValueError, m.move, 1, 1, -1)
+ # segfault test (Issue 5387)
+ m = mmap.mmap(-1, 100)
+ offsets = [-100, -1, 0, 1, 100]
+ for source, dest, size in itertools.product(offsets, offsets, offsets):
+ try:
+ m.move(source, dest, size)
+ except ValueError:
+ pass
+ self.assertRaises(ValueError, m.move, -1, -1, -1)
+ self.assertRaises(ValueError, m.move, -1, -1, 0)
+ self.assertRaises(ValueError, m.move, -1, 0, -1)
+ self.assertRaises(ValueError, m.move, 0, -1, -1)
+ self.assertRaises(ValueError, m.move, -1, 0, 0)
+ self.assertRaises(ValueError, m.move, 0, -1, 0)
+ self.assertRaises(ValueError, m.move, 0, 0, -1)
m.close()
def test_anonymous(self):
diff --git a/Modules/mmapmodule.c b/Modules/mmapmodule.c
index bd7f7cc..cbacc2f 100644
--- a/Modules/mmapmodule.c
+++ b/Modules/mmapmodule.c
@@ -617,7 +617,7 @@
} else {
/* bounds check the values */
unsigned long pos = src > dest ? src : dest;
- if (self->size >= pos && count > self->size - pos) {
+ if (self->size < pos || count > self->size - pos) {
PyErr_SetString(PyExc_ValueError,
"source or destination out of range");
return NULL;