gh-157335: Fix out-of-bounds write in mmap.mmap.__setitem__

Lib/test/test_mmap.py

@@ -953,6 +953,24 @@ def test_resize_down_anonymous_mapping(self):
                 with self.assertRaises(ValueError):
                     m.resize(start_size)
 
+    def test_setitem_resize_reentrancy(self):
+        """Resizing the mmap from inside __index__ while assigning to a
+        single item must not access memory past the new bounds (gh-157335)."""
+        size = 2 * PAGESIZE
+        new_size = PAGESIZE
+
+        class ResizeOnIndex:
+            def __init__(self, m):
+                self.m = m
+            def __index__(self):
+                self.m.resize(new_size)
+                return 0
+
+        with mmap.mmap(-1, size) as m:
+            with self.assertRaises(IndexError):
+                m[size - 1] = ResizeOnIndex(m)
+            self.assertEqual(len(m), new_size)
+
     @unittest.skipUnless(os.name == 'nt', 'requires Windows')
     def test_resize_fails_if_mapping_held_elsewhere(self):
         """If more than one mapping is held against a named file on Windows, neither

Misc/NEWS.d/next/Library/2026-09-13-15-58-28.gh-issue-157335.efaMah.rst

@@ -0,0 +1,3 @@
+Fix out-of-bounds write in :meth:`mmap.mmap.__setitem__` that could occur
+when the assigned value's :meth:`~object.__index__` method resized the
+mmap object during the assignment.

Modules/mmapmodule.c

@@ -1687,6 +1687,13 @@ mmap_ass_subscript_lock_held(PyObject *op, PyObject *item, PyObject *value)
             return -1;
         }
         CHECK_VALID(-1);
+        /* value's __index__ may have resized the mmap, invalidating
+         * the earlier bounds check on i. */
+        if (i >= self->size) {
+            PyErr_SetString(PyExc_IndexError,
+                            "mmap index out of range");
+            return -1;
+        }
 
         char v_char = (char) v;
         if (safe_byte_copy(self->data + i, &v_char) < 0) {