Issue #5386: mmap.write_byte didn't check map size, so it could cause buffer
overrun.
diff --git a/Modules/mmapmodule.c b/Modules/mmapmodule.c
index fad60d1..8407c11 100644
--- a/Modules/mmapmodule.c
+++ b/Modules/mmapmodule.c
@@ -365,10 +365,17 @@
if (!is_writeable(self))
return NULL;
- *(self->data+self->pos) = value;
- self->pos += 1;
- Py_INCREF(Py_None);
- return Py_None;
+
+ if (self->pos < self->size) {
+ *(self->data+self->pos) = value;
+ self->pos += 1;
+ Py_INCREF(Py_None);
+ return Py_None;
+ }
+ else {
+ PyErr_SetString(PyExc_ValueError, "write byte out of range");
+ return NULL;
+ }
}
static PyObject *