GeezerVison

…Assigning to a single index causes mmap.mmap.__setitem__ to validate the index against the object's size, which then converts the assigned value via PyNumber_AsSsize_t(). This invokes arbitrary python code via __index__(). mmap.resize(), which shrinks mapping could point past the end fo the new buffer causing an out of bounds error write.

Fix the same reentrancy issue in the slice-assignment path: acquiring
the value's buffer (e.g. via a __buffer__ method) can also run
arbitrary code that resizes the mmap, invalidating the previously
computed slice bounds. Re-validate the bounds after acquiring the
buffer, before copying into the mapping.

Clarify why the single-item path still needs a bounds check both
before and after converting the value: the earlier check preserves
existing error precedence (IndexError before TypeError, per
test_basic), while the later one is a narrow revalidation of just the
upper bound.

…om/Joekrry/cpython into fix-mmap-setitem-resize-reentrancy

vstinner left a comment

Co-authored-by: Victor Stinner <[email protected]>

…faMah.rst

Co-authored-by: Victor Stinner <[email protected]>

Co-authored-by: Victor Stinner <[email protected]>

Co-authored-by: Victor Stinner <[email protected]>

vstinner left a comment