Backport:

Fix SF bug #1402308, segfault when using mmap(-1, ...)

This didn't crash on Linux, but valgrind complained.
I'm not sure if this test is valid on Windows.

diff --git a/Lib/test/output/test_mmap b/Lib/test/output/test_mmap
index 1706ad58680585e1d760d3ee3616c0c31984127e..574581c01251a220f7665ef10ca86f72d3d9b065 100644 (file)
--- a/Lib/test/output/test_mmap
+++ b/Lib/test/output/test_mmap
@@ -31,4 +31,5 @@ test_mmap
   Modifying copy-on-write memory map.
   Ensuring copy-on-write maps cannot be resized.
   Ensuring invalid access parameter raises exception.
+  Try opening a bad file descriptor...
  Test passed

diff --git a/Lib/test/test_mmap.py b/Lib/test/test_mmap.py
index 77f717c336c2223472fa5a2c5103bddce0e000f2..91cfe83a69bacb4da103461db19952db1a16a078 100644 (file)
--- a/Lib/test/test_mmap.py
+++ b/Lib/test/test_mmap.py
@@ -281,6 +281,14 @@ def test_both():
         except OSError:
             pass
 
+    print '  Try opening a bad file descriptor...'
+    try:
+        mmap.mmap(-1, 4096)
+    except mmap.error:
+        pass
+    else:
+        verify(0, 'expected a mmap.error but did not get it')
+
     # Do a tougher .find() test.  SF bug 515943 pointed out that, in 2.2,
     # searching for data with embedded \0 bytes didn't work.
     f = open(TESTFN, 'w+')

diff --git a/Misc/ACKS b/Misc/ACKS
index ff5a9695e3e3e883cd544c5bff750d3e8dd016ef..350c5eab872944c008f85c33e03c410928fcebcd 100644 (file)
--- a/Misc/ACKS
+++ b/Misc/ACKS
@@ -520,6 +520,7 @@ Michael Scharf
 Neil Schemenauer
 David Scherer
 Gregor Schmid
+Ralf Schmitt
 Peter Schneider-Kamp
 Sam Schulenburg
 Stefan Schwarzer

diff --git a/Misc/NEWS b/Misc/NEWS
index b1a938b9be857c615b7619a013c98185ef48c39c..5c1ba30fc0fb35a91c69363c9805c3308fc72166 100644 (file)
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -206,6 +206,8 @@ Core and builtins
 Extension Modules
 -----------------
 
+- Bug #1402308, (possible) segfault when using mmap.mmap(-1, ...)
+
 - Bug #1400822, _curses over{lay,write} doesn't work when passing 6 ints.
   Also fix ungetmouse() which did not accept arguments properly.
   The code now conforms to the documented signature.

diff --git a/Modules/mmapmodule.c b/Modules/mmapmodule.c
index db24e46d6a5f99cdf5ba9671095cf2fd206994ed..9fd2ca48263c3696039fe265fbcaa79c7a670e04 100644 (file)
--- a/Modules/mmapmodule.c
+++ b/Modules/mmapmodule.c
@@ -914,6 +914,7 @@ new_mmap_object(PyObject *self, PyObject *args, PyObject *kwdict)
 #endif
        m_obj = PyObject_New (mmap_object, &mmap_object_type);
        if (m_obj == NULL) {return NULL;}
+       m_obj->data = NULL;
        m_obj->size = (size_t) map_size;
        m_obj->pos = (size_t) 0;
        m_obj->fd = dup(fd);