Issue #1733986: Fixed mmap crash in accessing elements of second map object
with same tagname but larger size than first map. (Windows)
diff --git a/Lib/test/test_mmap.py b/Lib/test/test_mmap.py
index c8e52a6..1ad611d 100644
--- a/Lib/test/test_mmap.py
+++ b/Lib/test/test_mmap.py
@@ -499,6 +499,34 @@
m.seek(8)
self.assertRaises(ValueError, m.write, "bar")
+ if os.name == 'nt':
+ def test_tagname(self):
+ data1 = "0123456789"
+ data2 = "abcdefghij"
+ assert len(data1) == len(data2)
+ # Test same tag
+ m1 = mmap.mmap(-1, len(data1), tagname="foo")
+ m1[:] = data1
+ m2 = mmap.mmap(-1, len(data2), tagname="foo")
+ m2[:] = data2
+ self.assertEquals(m1[:], data2)
+ self.assertEquals(m2[:], data2)
+ # Test differnt tag
+ m1 = mmap.mmap(-1, len(data1), tagname="foo")
+ m1[:] = data1
+ m2 = mmap.mmap(-1, len(data2), tagname="boo")
+ m2[:] = data2
+ self.assertEquals(m1[:], data1)
+ self.assertEquals(m2[:], data2)
+
+ def test_tagname_crash(self):
+ # Should not crash (Issue 1733986)
+ m = mmap.mmap(-1, 1000, tagname="foo")
+ try:
+ mmap.mmap(-1, 5000, tagname="foo")[:] # same tagname, but larger size
+ except:
+ pass
+
def test_main():
run_unittest(MmapTests)
diff --git a/Misc/NEWS b/Misc/NEWS
index 0ced972..36567f7 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -166,6 +166,9 @@
Library
-------
+- Issue #1733986: Fixed mmap crash in accessing elements of second map object
+ with same tagname but larger size than first map. (Windows)
+
- Issue #5386: mmap.write_byte didn't check map size, so it could cause buffer
overrun.
diff --git a/Modules/mmapmodule.c b/Modules/mmapmodule.c
index 8407c11..ca5fa88 100644
--- a/Modules/mmapmodule.c
+++ b/Modules/mmapmodule.c
@@ -1373,7 +1373,7 @@
dwDesiredAccess,
off_hi,
off_lo,
- 0);
+ m_obj->size);
if (m_obj->data != NULL)
return (PyObject *)m_obj;
else