mmap.read() crashes when passed a negative count:

    def test_read_negative(self):
        f = open(TESTFN, 'w+')
        f.write("ABCDE\0abcde")
        f.flush()

        mf = mmap.mmap(f.fileno(), 0)

    self.assertEqual(mf.read(2),  "AB")    # OK
    self.assertEqual(mf.read(-1), "CDE")   # ??
    self.assertEqual(mf.read(-1), "BCDE")  # ??
    self.assertEqual(mf.read(-1), "ABCDE") # ??
    mf.read(-1)                            # crash!!

I don't know what mf.read(-1) should do: raise a ValueError, return the empty
string, or return everything from the current pos to len(mf)?

I don't know what mf.read(-1) should do
I'm not sure neither.

I think the problem is that mmap uses size_t as length, but uses
Py_ssize_t for PyArg_ParseTuple. (PyArg_ParseTuple doesn't support
size_t) I think this discrepancy should be fixed.

If mmap should use size_t because it should cover all possible memory
region which size_t can represent but Py_ssize_t cannot, maybe should
PyArg_ParseTuple support size_t?

Well, I would not care that much: you can never read more than
PY_SSIZE_T_MAX, because the mapped area and the string would not fit in
the addressable space of the process.

Hmm, I cannot reproduce the crash. I created the patch experimentally,
but I'm not confident with this patch. Especially here

+ if (n < 0)
+ n = PY_SSIZE_T_MAX;

because I don't have so much memory.

• if (n < 0)

I suggest a comment like:

/* The difference can overflow, only if self->size is greater than

• PY_SSIZE_T_MAX. But then the operation cannot possibly succeed,
• because the mapped area and the returned string each need more
• than half of the addressable memory. So we clip the size, and let
• the code below raise MemoryError.
  */

OK, how about this patch?

OK for me.

Thanks, committed in r73677(trunk), r73682(release26-maint),
r73684(py3k), r73685(release31-maint).