gh-103987: fix crash in mmap module

Lib/test/test_mmap.py

@@ -264,6 +264,102 @@ def test_bad_file_desc(self):
  # Try opening a bad file descriptor...
  self.assertRaises(OSError, mmap.mmap, -2, 4096)
 
+ def test_unexpected_mmap_close_scenario_1(self):
+ # See gh-103987
+ with open(TESTFN, "wb+") as f:
+ data = b'aabaac\x00deef\x00\x00aa\x00'
+ n = len(data)
+ f.write(data)
+ f.flush()
+
+ class X:
+ def __index__(self):
+ m.close()
+ return 1
+
+ m = mmap.mmap(f.fileno(), n, access=mmap.ACCESS_READ)
+
+ self.assertEqual(m[1], 97)
+ with self.assertRaises(ValueError):
+ m[X()] # should not crash
+
+
+ def test_unexpected_mmap_close_scenario_2(self):
+ # See gh-103987
+ with open(TESTFN, "wb+") as f:
+ data = b'aabaac\x00deef\x00\x00aa\x00'
+ n = len(data)
+ f.write(data)
+ f.flush()
+
+ class X:
+ def __index__(self):
+ m.close()
+ return 1
+
+ m = mmap.mmap(f.fileno(), n, access=mmap.ACCESS_READ)
+
+ self.assertEqual(m[1], 97)
+ with self.assertRaises(ValueError):
+ m[X():5] # should not crash
+
+ def test_unexpected_mmap_close_scenario_3(self):
+ # See gh-103987
+ with open(TESTFN, "wb+") as f:
+ data = b'aabaac\x00deef\x00\x00aa\x00'
+ n = len(data)
+ f.write(data)
+ f.flush()
+
+ class X:
+ def __index__(self):
+ m.close()
+ return 1
+
+ m = mmap.mmap(f.fileno(), n, access=mmap.ACCESS_WRITE)
+
+
+ with self.assertRaises(ValueError):
+ m[X()] = 1 # should not crash
+
+ def test_unexpected_mmap_close_scenario_4(self):
+ # See gh-103987
+ with open(TESTFN, "wb+") as f:
+ data = b'aabaac\x00deef\x00\x00aa\x00'
+ n = len(data)
+ f.write(data)
+ f.flush()
+
+ class X:
+ def __index__(self):
+ m.close()
+ return 1
+
+ m = mmap.mmap(f.fileno(), n, access=mmap.ACCESS_WRITE)
+
+
+ with self.assertRaises(ValueError):
+ m[X():5] = b'abcd' # should not crash
+
+ def test_unexpected_mmap_close_scenario_5(self):
+ # See gh-103987
+ with open(TESTFN, "wb+") as f:
+ data = b'aabaac\x00deef\x00\x00aa\x00'
+ n = len(data)
+ f.write(data)
+ f.flush()
+
+ class X:
+ def __index__(self):
+ m.close()
+ return 1
+
+ m = mmap.mmap(f.fileno(), n, access=mmap.ACCESS_WRITE)
+
+
+ with self.assertRaises(ValueError):
+ m[X():5:1] = b'abcd' # should not crash
+
  def test_tougher_find(self):
  # Do a tougher .find() test. SF bug 515943 pointed out that, in 2.2,
  # searching for data with embedded \0 bytes didn't work.

Misc/NEWS.d/next/Library/2023-04-29-18-23-16.gh-issue-103987.sRgALL.rst

@@ -0,0 +1 @@
+add more ``CHECK_VALID`` s in ``mmapmodule.c`` to avoid the file being invalidated by Python code.

Modules/mmapmodule.c

@@ -945,6 +945,7 @@ mmap_subscript(mmap_object *self, PyObject *item)
  "mmap index out of range");
  return NULL;
  }
+ CHECK_VALID(NULL);
  return PyLong_FromLong(Py_CHARMASK(self->data[i]));
  }
  else if (PySlice_Check(item)) {
@@ -953,6 +954,7 @@ mmap_subscript(mmap_object *self, PyObject *item)
  if (PySlice_Unpack(item, &start, &stop, &step) < 0) {
  return NULL;
  }
+ CHECK_VALID(NULL);
  slicelen = PySlice_AdjustIndices(self->size, &start, &stop, step);
 
  if (slicelen <= 0)
@@ -968,6 +970,8 @@ mmap_subscript(mmap_object *self, PyObject *item)
 
  if (result_buf == NULL)
  return PyErr_NoMemory();
+ CHECK_VALID(NULL);
+
  for (cur = start, i = 0; i < slicelen;
  cur += step, i++) {
  result_buf[i] = self->data[cur];
@@ -1052,6 +1056,7 @@ mmap_ass_subscript(mmap_object *self, PyObject *item, PyObject *value)
  "in range(0, 256)");
  return -1;
  }
+ CHECK_VALID(-1);
  self->data[i] = (char) v;
  return 0;
  }
@@ -1077,6 +1082,7 @@ mmap_ass_subscript(mmap_object *self, PyObject *item, PyObject *value)
  return -1;
  }
 
+ CHECK_VALID(-1);
  if (slicelen == 0) {
  }
  else if (step == 1) {