This issue tracker has been migrated to GitHub, and is currently read-only.
For more information, see the GitHub FAQs in the Python's Developer Guide.

Title: mmap.move crashes by integer overflow
Type: crash Stage:
Components: Extension Modules Versions: Python 3.0, Python 3.1, Python 2.7, Python 2.6
Status: closed Resolution: fixed
Dependencies: Superseder:
Assigned To: Nosy List: jackdied, ocean-city
Priority: normal Keywords: patch

Created on 2009-02-27 17:45 by ocean-city, last changed 2022-04-11 14:56 by admin. This issue is now closed.

File name Uploaded Description Edit
fix_mmap_move.patch ocean-city, 2009-03-08 23:55
issue_5387.patch jackdied, 2009-03-26 19:30 fix mmap.move bounds checking, add tests
fix_mmap_move_v2.patch ocean-city, 2009-03-31 19:04
test_mmap_harder.patch jackdied, 2009-03-31 19:32 test more corner cases in mmap.move
Messages (9)
msg82854 - (view) Author: Hirokazu Yamamoto (ocean-city) * (Python committer) Date: 2009-02-27 17:45
mmap.move crashes by integer overflow. See

import mmap
data = mmap.mmap(-1, 1)
data.move(1,1,-1) # crash

Maybe mmap.move should use Py_ssize_t and raise
IndexError(OverflowError?) for negative value.

The patch is in r69943.
msg83338 - (view) Author: Hirokazu Yamamoto (ocean-city) * (Python committer) Date: 2009-03-08 23:55
I tried r69943 on coLinux, and I got compile error "max is not defined".
Here is updated patch.
msg84201 - (view) Author: Jack Diederich (jackdied) * (Python committer) Date: 2009-03-26 19:30
Here is a more verbose patch.  It checks to see if the first two
arguments stand-alone as well.  It also updates NEWS and ACKs and adds
some assertRaises for various bounds checks.
msg84771 - (view) Author: Hirokazu Yamamoto (ocean-city) * (Python committer) Date: 2009-03-31 13:05
Well, I think your patch has some issues.

>>> import mmap
>>> m = mmap.mmap(-1, 10)
>>> m.move(10, 10, 0) # legal, should not fail
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
ValueError: source out of range
>>> m.move(9, 9, -1) # should not crash

I hesitated to commit my patch because mmap.move is using unsigned long,
but I thought it should use size_t or Py_ssize_t (If mmap should
represent total memory area, it may have to use size_t, but maybe it
should use Py_ssize_t as well as other python modules like string)

Anyway, I'll commit my patch before Python2.6.2 will be released. Crash
is not good thing for any time. :-)
msg84782 - (view) Author: Hirokazu Yamamoto (ocean-city) * (Python committer) Date: 2009-03-31 14:08
Committed in r70800(trunk), r70803(release26-maint), r70808(py3k),
msg84856 - (view) Author: Jack Diederich (jackdied) * (Python committer) Date: 2009-03-31 18:39
running a fresh 2.7 trunk
>>> a
<mmap.mmap object at 0xb7d9f9c0>
>>> a.move(-1, -1, -1
... )
Segmentation fault
jack@sprat:~/src/python-rw$ ./python 
Python 2.7a0 (trunk:70847M, Mar 31 2009, 14:14:31) 
[GCC 4.3.2] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import mmap
>>> a = mmap.mmap(-1, 1000)
>>> a.move(0, 0, 0)
>>> a.move(-1, -1, 1)
Segmentation fault
msg84860 - (view) Author: Hirokazu Yamamoto (ocean-city) * (Python committer) Date: 2009-03-31 19:04
Yes, you are right... My patch was not correct neigher. :-(
Here is revised patch.
msg84877 - (view) Author: Jack Diederich (jackdied) * (Python committer) Date: 2009-03-31 19:32
Looks good.  Attached is a more thorough patch that would
have found the bugs in both our patches ;)
msg84887 - (view) Author: Hirokazu Yamamoto (ocean-city) * (Python committer) Date: 2009-03-31 20:14
I've committed your test with some modification. (r70879) Thanks!
Date User Action Args
2022-04-11 14:56:46adminsetgithub: 49637
2009-03-31 20:14:50ocean-citysetmessages: + msg84887
2009-03-31 19:32:47jackdiedsetstatus: open -> closed
files: + test_mmap_harder.patch
resolution: fixed
messages: + msg84877
2009-03-31 19:05:00ocean-citysetstatus: closed -> open
files: + fix_mmap_move_v2.patch
resolution: fixed -> (no value)
messages: + msg84860
2009-03-31 18:39:13jackdiedsetmessages: + msg84856
2009-03-31 14:08:13ocean-citysetstatus: open -> closed
resolution: fixed
messages: + msg84782
2009-03-31 13:05:40ocean-citysetmessages: + msg84771
2009-03-26 19:30:09jackdiedsetfiles: + issue_5387.patch
nosy: + jackdied
messages: + msg84201

2009-03-08 23:55:44ocean-citysetfiles: + fix_mmap_move.patch
keywords: + patch
messages: + msg83338
2009-02-27 17:45:15ocean-citycreate