gh-157335: Fixed out of bounds write in mmap.mmap.__setitem__. Assigning to a single index causes mmap.mmap.__setitem__ to validate the index against the object's size, which then converts the assigned value via PyNumber_AsSsize_t(). This invokes arbitrary python code via __index__(). mmap.resize(), which shrinks mapping could point past the end fo the new buffer causing an out of bounds error write. · python/cpython@c9b2513

6s

7s

13s

Navigation Menu