gh-103987: fix crash in mmap module

Lib/test/test_mmap.py

@@ -264,6 +264,49 @@ def test_bad_file_desc(self):
  # Try opening a bad file descriptor...
  self.assertRaises(OSError, mmap.mmap, -2, 4096)
 
+ def test_unexpected_mmap_close_scenario_1(self):
+ # See gh-103987
+ with open(TESTFN, "wb+") as f:
+ data = b'aabaac\x00deef\x00\x00aa\x00'
+ n = len(data)
+ f.write(data)
+ f.flush()
+
+ class X:
+ def __index__(self):
+ m.close()
+ return 1
+
+ m = mmap.mmap(f.fileno(), n, access=mmap.ACCESS_READ)
+
+ self.assertEqual(m[1], 97)
+ with self.assertRaises(ValueError):
+ m[X()] # should not crash
+
+ with self.assertRaises(ValueError):
+ m[X():5] # should not crash
+
+ m.close() # first CHECK_VALID will pick and raise ValueError
+ with self.assertRaises(ValueError):
+ m[0:5] # should not crash
+
+
+ def test_unexpected_mmap_close_scenario_2(self):
+
+ with open(TESTFN, "wb+") as f:
+ data = b'aabaac\x00deef\x00\x00aa\x00'
+ n = len(data)
+ f.write(data)
+ f.flush()
+
+ m = mmap.mmap(f.fileno(), n, access=mmap.ACCESS_READ)
+
+ m.close()
+ with self.assertRaises(ValueError):
+ m["abc"] # first CHECK_VALID will pick and raise ValueError
+
+
+
  def test_tougher_find(self):
  # Do a tougher .find() test. SF bug 515943 pointed out that, in 2.2,
  # searching for data with embedded \0 bytes didn't work.

Misc/NEWS.d/next/Library/2023-04-29-18-23-16.gh-issue-103987.sRgALL.rst

@@ -0,0 +1 @@
+Fix ``mmap_subscript`` in mmapmodule.c to avoid segmentation fault

Modules/mmapmodule.c

@@ -936,6 +936,7 @@ mmap_subscript(mmap_object *self, PyObject *item)
  CHECK_VALID(NULL);
  if (PyIndex_Check(item)) {
  Py_ssize_t i = PyNumber_AsSsize_t(item, PyExc_IndexError);
+ CHECK_VALID(NULL);
  if (i == -1 && PyErr_Occurred())
  return NULL;
  if (i < 0)