Index: Misc/NEWS =================================================================== --- Misc/NEWS (revision 70604) +++ Misc/NEWS (working copy) @@ -676,6 +676,8 @@ - Issue #4396: The parser module now correctly validates the with statement. +- Issue #5378: Stricter bounds check on mmap.move() to prevent segfaults from bad ranges. + Tests ----- Index: Misc/ACKS =================================================================== --- Misc/ACKS (revision 70604) +++ Misc/ACKS (working copy) @@ -775,6 +775,7 @@ Thomas Wouters Heiko Wundram Doug Wyatt +Hirokazu Yamamoto Ka-Ping Yee Bob Yodlowski Danny Yoo @@ -787,6 +788,6 @@ Mike Zarnstorff Siebren van der Zee Uwe Zessin -Tarek ZiadŽ +Tarek ZiadÂŽ Peter Åstrand Jesse Noller Index: Lib/test/test_mmap.py =================================================================== --- Lib/test/test_mmap.py (revision 70604) +++ Lib/test/test_mmap.py (working copy) @@ -335,6 +335,15 @@ mf = mmap.mmap(f.fileno(), 10) mf.move(5, 0, 5) self.assertEqual(mf[:], "ABCDEABCDE", "Map move should have duplicated front 5") + + # check bounds checking + self.assertRaises(ValueError, mf.move, -1, 0, 1) + self.assertRaises(ValueError, mf.move, 0, -1, 1) + self.assertRaises(ValueError, mf.move, 0, 0, -1) + self.assertRaises(ValueError, mf.move, mf.size(), 0, 1) + self.assertRaises(ValueError, mf.move, 0, mf.size(), 1) + self.assertEqual(None, mf.move(0, 0, 0)) + mf.close() f.close() Index: Modules/mmapmodule.c =================================================================== --- Modules/mmapmodule.c (revision 70604) +++ Modules/mmapmodule.c (working copy) @@ -612,13 +612,14 @@ return NULL; } else { /* bounds check the values */ - if (/* end of source after end of data?? */ - ((src+count) > self->size) - /* dest will fit? */ - || (dest+count > self->size)) { + if (src >= self->size || (src+count) > self->size) { PyErr_SetString(PyExc_ValueError, - "source or destination out of range"); + "source out of range"); return NULL; + } else if (dest >= self->size || (dest+count) > self->size) { + PyErr_SetString(PyExc_ValueError, + "destination out of range"); + return NULL; } else { memmove(self->data+dest, self->data+src, count); Py_INCREF(Py_None);