Segfault when using re.finditer over mmap

[fijall]

BPO	14212
Nosy	@benjaminp, @alex, @skrah
Files	x.py

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = <Date 2012-03-07.21:01:36.156>
created_at = <Date 2012-03-06.18:00:15.497>
labels = ['type-crash']
title = 'Segfault when using re.finditer over mmap'
updated_at = <Date 2012-03-07.21:01:36.155>
user = 'https://bugs.python.org/fijall'

bugs.python.org fields:

activity = <Date 2012-03-07.21:01:36.155>
actor = 'benjamin.peterson'
assignee = 'none'
closed = True
closed_date = <Date 2012-03-07.21:01:36.156>
closer = 'benjamin.peterson'
components = []
creation = <Date 2012-03-06.18:00:15.497>
creator = 'fijall'
dependencies = []
files = ['24747']
hgrepos = []
issue_num = 14212
keywords = []
message_count = 5.0
messages = ['155028', '155033', '155105', '155121', '155122']
nosy_count = 6.0
nosy_names = ['benjamin.peterson', 'mrabarnett', 'alex', 'skrah', 'fijall', 'python-dev']
pr_nums = []
priority = 'normal'
resolution = 'fixed'
stage = None
status = 'closed'
superseder = None
type = 'crash'
url = 'https://bugs.python.org/issue14212'
versions = ['Python 2.7']

[fijall]

Example to get a segfault attached. Crashes under python3 as well.

[mrabarnett]

It segfaults because it attempts to access the buffer of an mmap that has been closed. It would be certainly be more friendly if it checked whether the mmap was still open and, if not, raised an exception instead.

[mrabarnett]

In the function "getstring" in _sre.c, the code obtains a pointer to the characters of the buffer and then releases the buffer.

There's a comment before the release:

    /* Release the buffer immediately --- possibly dangerous
       but doing something else would require some re-factoring
    */
    PyBuffer_Release(&view);

What's happening is that after the mmap is closed the pointer is no longer valid.

[python-dev]

New changeset 10a79a33d09b by Benjamin Peterson in branch '3.2':
keep the buffer object around while we're using it (closes bpo-14212)
http://hg.python.org/cpython/rev/10a79a33d09b

New changeset 17dfe24e5107 by Benjamin Peterson in branch 'default':
merge 3.2 (bpo-14212)
http://hg.python.org/cpython/rev/17dfe24e5107

[benjaminp]

I think 2.7 might be hopeless.