Issue #10955: Fix a potential crash when trying to mmap() a file past its
length. Initial patch by Ross Lagerwall.
This fixes a regression introduced by r88022.
diff --git a/Modules/mmapmodule.c b/Modules/mmapmodule.c
index f3b2f50..a9049ed 100644
--- a/Modules/mmapmodule.c
+++ b/Modules/mmapmodule.c
@@ -1116,6 +1116,11 @@
# endif
if (fd != -1 && fstat(fd, &st) == 0 && S_ISREG(st.st_mode)) {
if (map_size == 0) {
+ if (offset >= st.st_size) {
+ PyErr_SetString(PyExc_ValueError,
+ "mmap offset is greater than file size");
+ return NULL;
+ }
map_size = st.st_size - offset;
} else if ((size_t)offset + (size_t)map_size > st.st_size) {
PyErr_SetString(PyExc_ValueError,
@@ -1300,6 +1305,12 @@
else
m_obj->size = low;
#endif
+ if (offset >= m_obj->size) {
+ PyErr_SetString(PyExc_ValueError,
+ "mmap offset is greater than file size");
+ Py_DECREF(m_obj);
+ return NULL;
+ }
m_obj->size -= offset;
} else {
m_obj->size = map_size;