Mercurial > cpython-lru_cache-weakref
diff Modules/mmapmodule.c @ 52670:a73373ccccc2 legacy-trunk
bounds check arguments to mmap.move(). All of them. Really.
fixes crasher on OS X 10.5
| author | Jack Diederich <jackdied@gmail.com> |
|---|---|
| date | Wed, 01 Apr 2009 20:26:13 +0000 |
| parents | 3aea75a34337 |
| children | 0151029de1d9 |
line wrap: on
line diff
--- a/Modules/mmapmodule.c Wed Apr 01 20:25:48 2009 +0000 +++ b/Modules/mmapmodule.c Wed Apr 01 20:26:13 2009 +0000 @@ -609,23 +609,23 @@ static PyObject * mmap_move_method(mmap_object *self, PyObject *args) { - unsigned long dest, src, count; + unsigned long dest, src, cnt; CHECK_VALID(NULL); - if (!PyArg_ParseTuple(args, "kkk:move", &dest, &src, &count) || + if (!PyArg_ParseTuple(args, "kkk:move", &dest, &src, &cnt) || !is_writeable(self)) { return NULL; } else { /* bounds check the values */ - unsigned long pos = src > dest ? src : dest; - if (self->size < pos || count > self->size - pos) { + if (cnt < 0 || (cnt + dest) < cnt || (cnt + src) < cnt || + src < 0 || src > self->size || (src + cnt) > self->size || + dest < 0 || dest > self->size || (dest + cnt) > self->size) { PyErr_SetString(PyExc_ValueError, - "source or destination out of range"); + "source, destination, or count out of range"); return NULL; - } else { - memmove(self->data+dest, self->data+src, count); - Py_INCREF(Py_None); - return Py_None; } + memmove(self->data+dest, self->data+src, cnt); + Py_INCREF(Py_None); + return Py_None; } }
