mirrors/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2025-11-25 12:44:13 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 11

bounds check arguments to mmap.move(). All of them. Really.

Browse source 
fixes crasher on OS X 10.5
This commit is contained in:
Jack Diederich 2009-04-01 20:26:13 +00:00
parent ce3d221447
commit 2ecd3c36b5
2 changed files with 23 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

18
Modules/mmapmodule.c
View file

@ -609,23 +609,23 @@ mmap_seek_method(mmap_object *self, PyObject *args)
static PyObject *
mmap_move_method(mmap_object *self, PyObject *args)
{
unsigned long dest, src, count;
unsigned long dest, src, cnt;
CHECK_VALID(NULL);
if (!PyArg_ParseTuple(args, "kkk:move", &dest, &src, &count) ||
if (!PyArg_ParseTuple(args, "kkk:move", &dest, &src, &cnt) ||
!is_writeable(self)) {
return NULL;
} else {
/* bounds check the values */
unsigned long pos = src > dest ? src : dest;
if (self->size < pos || count > self->size - pos) {
if (cnt < 0 || (cnt + dest) < cnt || (cnt + src) < cnt ||
src < 0 || src > self->size || (src + cnt) > self->size ||
dest < 0 || dest > self->size || (dest + cnt) > self->size) {
PyErr_SetString(PyExc_ValueError,
"source or destination out of range");
"source, destination, or count out of range");
return NULL;
} else {
memmove(self->data+dest, self->data+src, count);
Py_INCREF(Py_None);
return Py_None;
}
memmove(self->data+dest, self->data+src, cnt);
Py_INCREF(Py_None);
return Py_None;
}
}