mmap crash

[rosslagerwall]

BPO	10959
Nosy	@birkenfeld, @amauryfa, @pitrou
Files	mmap_issue.patch mmap_10959.patch

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = <Date 2011-01-20.21:20:49.492>
created_at = <Date 2011-01-20.17:00:34.493>
labels = ['type-crash']
title = 'mmap crash'
updated_at = <Date 2011-01-20.21:20:49.491>
user = 'https://bugs.python.org/rosslagerwall'

bugs.python.org fields:

activity = <Date 2011-01-20.21:20:49.491>
actor = 'pitrou'
assignee = 'none'
closed = True
closed_date = <Date 2011-01-20.21:20:49.492>
closer = 'pitrou'
components = []
creation = <Date 2011-01-20.17:00:34.493>
creator = 'rosslagerwall'
dependencies = []
files = ['20466', '20470']
hgrepos = []
issue_num = 10959
keywords = ['patch']
message_count = 3.0
messages = ['126629', '126645', '126646']
nosy_count = 4.0
nosy_names = ['georg.brandl', 'amaury.forgeotdarc', 'pitrou', 'rosslagerwall']
pr_nums = []
priority = 'normal'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'crash'
url = 'https://bugs.python.org/issue10959'
versions = ['Python 3.1', 'Python 2.7', 'Python 3.2']

[rosslagerwall]

The fix for bpo-10916 commited in r88022 introduces this line:

map_size = st.st_size - offset;

If offset > st.st_size, map_size is negative. This should cause the mmap system call to return -1 and set errno.

However, given a certain size of offset, since map_size is unsigned it will give a very large map_size and access the resultant mmap object results in a bus error crash. It also gives bogus len(mmap) values.

Eg (crashes on a 32bit system):
import os, mmap

with open("/tmp/rnd", "wb") as f:
    f.write(b"X" * 115699)

with open("/tmp/rnd", "w+b") as f:
    with mmap.mmap(f.fileno(), 0, offset=2147479552) as m:
        print(len(m))
        for i in m:
            print(m[i])

Attached is a patch which should fix this issue by raising a value error if offset > st.st_size.

[pitrou]

Here is an updated patch which also caters to the Windows side of things.

[pitrou]

Fixed in r88131 (3.2), r88132 (3.1) and r88133 (2.7). Thank you!