This issue tracker has been migrated to GitHub, and is currently read-only.
For more information, see the GitHub FAQs in the Python's Developer Guide.

classification
Title: mmap.mmap can overrun buffer
Type: crash Stage:
Components: Windows Versions: Python 3.0, Python 3.1, Python 2.7, Python 2.6
process
Status: closed Resolution: fixed
Dependencies: Superseder:
Assigned To: Nosy List: ocean-city, rupole
Priority: high Keywords: patch

Created on 2007-06-09 08:53 by rupole, last changed 2022-04-11 14:56 by admin. This issue is now closed.

Files
File name Uploaded Description Edit
mmap_crash.py rupole, 2007-06-09 08:53
fix_tagname_crash.patch ocean-city, 2009-02-24 16:53
Messages (3)
msg32292 - (view) Author: Roger Upole (rupole) Date: 2007-06-09 08:53
When opening a named mapping (windows only) that already exists, the size is ignored but the constructor assumes the passed-in size is the buffer size.  If you specify a size larger than the original, the reopened mapping can write past the end of the valid buffer, resulting in a crash.
msg82668 - (view) Author: Hirokazu Yamamoto (ocean-city) * (Python committer) Date: 2009-02-24 16:53
I came from issue5335. I think attached patch will fix this issue.
msg82908 - (view) Author: Hirokazu Yamamoto (ocean-city) * (Python committer) Date: 2009-02-28 12:22
Fixed in r70056(trunk) and r70057(py3k).
History
Date User Action Args
2022-04-11 14:56:24adminsetgithub: 45072
2009-02-28 12:22:40ocean-citysetstatus: open -> closed
resolution: fixed
messages: + msg82908
2009-02-24 16:53:09ocean-citysetfiles: + fix_tagname_crash.patch
versions: + Python 2.6, Python 3.0, Python 3.1, Python 2.7
nosy: + ocean-city
messages: + msg82668
priority: normal -> high
keywords: + patch
type: crash
2009-02-24 16:51:19ocean-citylinkissue5335 superseder
2007-06-09 08:53:53rupolecreate