Merged revisions 88097 via svnmerge from

svn+ssh://pythondev@svn.python.org/python/branches/py3k

........
  r88097 | antoine.pitrou | 2011-01-18 19:57:52 +0100 (mar., 18 janv. 2011) | 4 lines

  Issue #10451: memoryview objects could allow to mutate a readable buffer.
  Initial patch by Ross Lagerwall.
........

diff --git a/Lib/test/test_memoryview.py b/Lib/test/test_memoryview.py
index 61e60fbdc932f59c52771d15b9847f39277c82d3..525ddeab23d1d0574cc5af200a217cf215d1fa4b 100644 (file)
--- a/Lib/test/test_memoryview.py
+++ b/Lib/test/test_memoryview.py
@@ -9,6 +9,7 @@ import gc
 import weakref
 import array
 from test import test_support
+import io
 
 
 class AbstractMemoryTests:
@@ -230,6 +231,16 @@ class AbstractMemoryTests:
             gc.collect()
             self.assertTrue(wr() is None, wr())
 
+    def test_writable_readonly(self):
+        # Issue #10451: memoryview incorrectly exposes a readonly
+        # buffer as writable causing a segfault if using mmap
+        tp = self.ro_type
+        if tp is None:
+            return
+        b = tp(self._source)
+        m = self._view(b)
+        i = io.BytesIO(b'ZZZZ')
+        self.assertRaises(TypeError, i.readinto, m)
 
 # Variations on source objects for the buffer: bytes-like objects, then arrays
 # with itemsize > 1.

diff --git a/Misc/NEWS b/Misc/NEWS
index 01412c776bfe539e80271f27f63a54f44138b117..dcfaece24cf9ab94223168b70775cad03c716011 100644 (file)
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -9,6 +9,9 @@ What's New in Python 2.7.2?
 Core and Builtins
 -----------------
 
+- Issue #10451: memoryview objects could allow to mutate a readable buffer.
+  Initial patch by Ross Lagerwall.
+
 - Issue #10892: Don't segfault when trying to delete __abstractmethods__ from a
   class.
 

diff --git a/Objects/memoryobject.c b/Objects/memoryobject.c
index 4997fcc6c965e4bec45ddf90db59142498438cec..2bac266ea7fda521076598f476b46b76f782b415 100644 (file)
--- a/Objects/memoryobject.c
+++ b/Objects/memoryobject.c
@@ -34,9 +34,6 @@ static int
 memory_getbuf(PyMemoryViewObject *self, Py_buffer *view, int flags)
 {
     int res = 0;
-    /* XXX for whatever reason fixing the flags seems necessary */
-    if (self->view.readonly)
-        flags &= ~PyBUF_WRITABLE;
     if (self->view.obj != NULL)
         res = PyObject_GetBuffer(self->view.obj, view, flags);
     if (view)
@@ -411,7 +408,7 @@ memory_tobytes(PyMemoryViewObject *self, PyObject *noargs)
     Py_buffer view;
     PyObject *res;
 
-    if (PyObject_GetBuffer((PyObject *)self, &view, PyBUF_FULL) < 0)
+    if (PyObject_GetBuffer((PyObject *)self, &view, PyBUF_SIMPLE) < 0)
         return NULL;
 
     res = PyBytes_FromStringAndSize(NULL, view.len);