Merged revisions 88097 via svnmerge from

pitrou · pitrou · commit 3013b16b62be · 2011-01-18T19:06:19.000Z
svn+ssh://pythondev@svn.python.org/python/branches/py3k ........ r88097 | antoine.pitrou | 2011-01-18 19:57:52 +0100 (mar., 18 janv. 2011) | 4 lines Issue #10451: memoryview objects could allow to mutate a readable buffer. Initial patch by Ross Lagerwall. ........
diff --git a/Lib/test/test_memoryview.py b/Lib/test/test_memoryview.py
@@ -9,6 +9,7 @@
 import weakref
 import array
 from test import test_support
+import io
 
 
 class AbstractMemoryTests:
@@ -230,6 +231,16 @@ class MyObject:
             gc.collect()
             self.assertTrue(wr() is None, wr())
 
+    def test_writable_readonly(self):
+        # Issue #10451: memoryview incorrectly exposes a readonly
+        # buffer as writable causing a segfault if using mmap
+        tp = self.ro_type
+        if tp is None:
+            return
+        b = tp(self._source)
+        m = self._view(b)
+        i = io.BytesIO(b'ZZZZ')
+        self.assertRaises(TypeError, i.readinto, m)
 
 # Variations on source objects for the buffer: bytes-like objects, then arrays
 # with itemsize > 1.
diff --git a/Misc/NEWS b/Misc/NEWS
@@ -9,6 +9,9 @@ What's New in Python 2.7.2?
 Core and Builtins
 -----------------
 
+- Issue #10451: memoryview objects could allow to mutate a readable buffer.
+  Initial patch by Ross Lagerwall.
+
 - Issue #10892: Don't segfault when trying to delete __abstractmethods__ from a
   class.
 
diff --git a/Objects/memoryobject.c b/Objects/memoryobject.c
@@ -34,9 +34,6 @@ static int
 memory_getbuf(PyMemoryViewObject *self, Py_buffer *view, int flags)
 {
     int res = 0;
-    /* XXX for whatever reason fixing the flags seems necessary */
-    if (self->view.readonly)
-        flags &= ~PyBUF_WRITABLE;
     if (self->view.obj != NULL)
         res = PyObject_GetBuffer(self->view.obj, view, flags);
     if (view)
@@ -411,7 +408,7 @@ memory_tobytes(PyMemoryViewObject *self, PyObject *noargs)
     Py_buffer view;
     PyObject *res;
 
-    if (PyObject_GetBuffer((PyObject *)self, &view, PyBUF_FULL) < 0)
+    if (PyObject_GetBuffer((PyObject *)self, &view, PyBUF_SIMPLE) < 0)
         return NULL;
 
     res = PyBytes_FromStringAndSize(NULL, view.len);
