From: Antoine Pitrou <solipsis@pitrou.net>
Date: Tue, 18 Jan 2011 19:06:09 +0000 (+0000)
Subject: Merged revisions 88097 via svnmerge from
X-Git-Tag: v3.2.1b1~347^2~54
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=566facd39b90595b1b7ab61a26c77e426ac22c73;p=thirdparty%2FPython%2Fcpython.git

Merged revisions 88097 via svnmerge from
svn+ssh://pythondev@svn.python.org/python/branches/py3k

........
  r88097 | antoine.pitrou | 2011-01-18 19:57:52 +0100 (mar., 18 janv. 2011) | 4 lines

  Issue #10451: memoryview objects could allow to mutate a readable buffer.
  Initial patch by Ross Lagerwall.
........
---

diff --git a/Lib/test/test_memoryview.py b/Lib/test/test_memoryview.py
index fd820b69e851..52fa3a935ff3 100644
--- a/Lib/test/test_memoryview.py
+++ b/Lib/test/test_memoryview.py
@@ -9,6 +9,7 @@ import sys
 import gc
 import weakref
 import array
+import io
 
 
 class AbstractMemoryTests:
@@ -225,6 +226,16 @@ class AbstractMemoryTests:
             gc.collect()
             self.assertTrue(wr() is None, wr())
 
+    def test_writable_readonly(self):
+        # Issue #10451: memoryview incorrectly exposes a readonly
+        # buffer as writable causing a segfault if using mmap
+        tp = self.ro_type
+        if tp is None:
+            return
+        b = tp(self._source)
+        m = self._view(b)
+        i = io.BytesIO(b'ZZZZ')
+        self.assertRaises(TypeError, i.readinto, m)
 
 # Variations on source objects for the buffer: bytes-like objects, then arrays
 # with itemsize > 1.
diff --git a/Misc/NEWS b/Misc/NEWS
index 1495bdd32670..abc496bdb284 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -10,6 +10,9 @@ What's New in Python 3.1.4?
 Core and Builtins
 -----------------
 
+- Issue #10451: memoryview objects could allow to mutate a readable buffer.
+  Initial patch by Ross Lagerwall.
+
 - Issue #10892: Don't segfault when trying to delete __abstractmethods__ from a
   class.
 
diff --git a/Objects/memoryobject.c b/Objects/memoryobject.c
index f5dacb04f20d..9b77ea726c17 100644
--- a/Objects/memoryobject.c
+++ b/Objects/memoryobject.c
@@ -34,9 +34,6 @@ static int
 memory_getbuf(PyMemoryViewObject *self, Py_buffer *view, int flags)
 {
     int res = 0;
-    /* XXX for whatever reason fixing the flags seems necessary */
-    if (self->view.readonly)
-        flags &= ~PyBUF_WRITABLE;
     if (self->view.obj != NULL)
         res = PyObject_GetBuffer(self->view.obj, view, flags);
     if (view)