diff options
| author | Hirokazu Yamamoto <ocean-city@m2.ccsnet.ne.jp> | 2009-02-28 10:31:54 +0000 |
|---|---|---|
| committer | Hirokazu Yamamoto <ocean-city@m2.ccsnet.ne.jp> | 2009-02-28 10:31:54 +0000 |
| commit | 963423eea503c0536914b34a4e635a65d714ed67 (patch) | |
| tree | e3bd036f042538917e4081c4320a46f2c3117e0f /Modules/mmapmodule.c | |
| parent | db4b39b3125f55e0bdb09c00bfba8628a137e732 (diff) | |
| download | cpython-963423eea503c0536914b34a4e635a65d714ed67.tar.gz | |
Issue #5386: mmap.write_byte didn't check map size, so it could cause buffer
overrun.
Diffstat (limited to 'Modules/mmapmodule.c')
| -rw-r--r-- | Modules/mmapmodule.c | 15 |
1 files changed, 11 insertions, 4 deletions
diff --git a/Modules/mmapmodule.c b/Modules/mmapmodule.c index fad60d109f..8407c11b3b 100644 --- a/Modules/mmapmodule.c +++ b/Modules/mmapmodule.c @@ -365,10 +365,17 @@ mmap_write_byte_method(mmap_object *self, if (!is_writeable(self)) return NULL; - *(self->data+self->pos) = value; - self->pos += 1; - Py_INCREF(Py_None); - return Py_None; + + if (self->pos < self->size) { + *(self->data+self->pos) = value; + self->pos += 1; + Py_INCREF(Py_None); + return Py_None; + } + else { + PyErr_SetString(PyExc_ValueError, "write byte out of range"); + return NULL; + } } static PyObject * |