gh-103987: fix crash in mmap module

Lib/test/test_mmap.py

@@ -264,6 +264,102 @@ def test_bad_file_desc(self):
         # Try opening a bad file descriptor...
         self.assertRaises(OSError, mmap.mmap, -2, 4096)
 
+    def test_unexpected_mmap_close_scenario_1(self):
+        # See gh-103987
+        with open(TESTFN, "wb+") as f:
+            data = b'aabaac\x00deef\x00\x00aa\x00'
+            n = len(data)
+            f.write(data)
+            f.flush()
+
+            class X:
+                def __index__(self):
+                    m.close()
+                    return 1
+
+            m = mmap.mmap(f.fileno(), n, access=mmap.ACCESS_READ)
+
+        self.assertEqual(m[1], 97)
+        with self.assertRaises(ValueError):
+            m[X()] # should not crash
+
+
+    def test_unexpected_mmap_close_scenario_2(self):
+        # See gh-103987
+        with open(TESTFN, "wb+") as f:
+            data = b'aabaac\x00deef\x00\x00aa\x00'
+            n = len(data)
+            f.write(data)
+            f.flush()
+
+            class X:
+                def __index__(self):
+                    m.close()
+                    return 1
+
+            m = mmap.mmap(f.fileno(), n, access=mmap.ACCESS_READ)
+
+        self.assertEqual(m[1], 97)
+        with self.assertRaises(ValueError):
+            m[X():5] # should not crash
+
+    def test_unexpected_mmap_close_scenario_3(self):
+        # See gh-103987
+        with open(TESTFN, "wb+") as f:
+            data = b'aabaac\x00deef\x00\x00aa\x00'
+            n = len(data)
+            f.write(data)
+            f.flush()
+
+            class X:
+                def __index__(self):
+                    m.close()
+                    return 1
+
+            m = mmap.mmap(f.fileno(), n, access=mmap.ACCESS_WRITE)
+
+
+        with self.assertRaises(ValueError):
+            m[X()] = 1 # should not crash
+
+    def test_unexpected_mmap_close_scenario_4(self):
+        # See gh-103987
+        with open(TESTFN, "wb+") as f:
+            data = b'aabaac\x00deef\x00\x00aa\x00'
+            n = len(data)
+            f.write(data)
+            f.flush()
+
+            class X:
+                def __index__(self):
+                    m.close()
+                    return 1
+
+            m = mmap.mmap(f.fileno(), n, access=mmap.ACCESS_WRITE)
+
+
+        with self.assertRaises(ValueError):
+            m[X():5] = b'abcd' # should not crash
+
+    def test_unexpected_mmap_close_scenario_5(self):
+        # See gh-103987
+        with open(TESTFN, "wb+") as f:
+            data = b'aabaac\x00deef\x00\x00aa\x00'
+            n = len(data)
+            f.write(data)
+            f.flush()
+
+            class X:
+                def __index__(self):
+                    m.close()
+                    return 1
+
+            m = mmap.mmap(f.fileno(), n, access=mmap.ACCESS_WRITE)
+
+
+        with self.assertRaises(ValueError):
+            m[X():5:1] = b'abcd' # should not crash
+
     def test_tougher_find(self):
         # Do a tougher .find() test.  SF bug 515943 pointed out that, in 2.2,
         # searching for data with embedded \0 bytes didn't work.

Misc/NEWS.d/next/Library/2023-04-29-18-23-16.gh-issue-103987.sRgALL.rst

@@ -0,0 +1 @@
+add more ``CHECK_VALID`` s in ``mmapmodule.c`` to avoid the file being invalidated by Python code.

Modules/mmapmodule.c

@@ -945,6 +945,7 @@ mmap_subscript(mmap_object *self, PyObject *item)
                 "mmap index out of range");
             return NULL;
         }
+        CHECK_VALID(NULL);
         return PyLong_FromLong(Py_CHARMASK(self->data[i]));
     }
     else if (PySlice_Check(item)) {
@@ -953,6 +954,7 @@ mmap_subscript(mmap_object *self, PyObject *item)
         if (PySlice_Unpack(item, &start, &stop, &step) < 0) {
             return NULL;
         }
+        CHECK_VALID(NULL);
         slicelen = PySlice_AdjustIndices(self->size, &start, &stop, step);
 
         if (slicelen <= 0)
@@ -968,6 +970,8 @@ mmap_subscript(mmap_object *self, PyObject *item)
 
             if (result_buf == NULL)
                 return PyErr_NoMemory();
+            CHECK_VALID(NULL);
+
             for (cur = start, i = 0; i < slicelen;
                  cur += step, i++) {
                 result_buf[i] = self->data[cur];
@@ -1052,6 +1056,7 @@ mmap_ass_subscript(mmap_object *self, PyObject *item, PyObject *value)
                             "in range(0, 256)");
             return -1;
         }
+        CHECK_VALID(-1);
         self->data[i] = (char) v;
         return 0;
     }
@@ -1077,6 +1082,7 @@ mmap_ass_subscript(mmap_object *self, PyObject *item, PyObject *value)
             return -1;
         }
 
+        CHECK_VALID(-1);
         if (slicelen == 0) {
         }
         else if (step == 1) {