René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"segfault in mmap object when using __index__ method that closes the mmap","articleBody":"The following (artificial) code segfaults CPython (I tried a bunch of versions, including git main) on my x86 Ubuntu Linux 22.10:\r\n\r\n```python\r\nimport mmap\r\n\r\nwith open(\"abcds\", \"w+\") as f:\r\n    f.write(\"foobar\")\r\n    f.flush()\r\n\r\n    class X(object):\r\n        def __index__(self):\r\n            m.close()\r\n            return 1\r\n\r\n    m = mmap.mmap(f.fileno(), 6, access=mmap.ACCESS_READ)\r\n\r\n    print(m[1])\r\n    print(m[X()])\r\n```\r\n\r\nThe problem is this code in `mmapmodule.c`\r\n\r\n```c\r\nstatic PyObject *\r\nmmap_subscript(mmap_object *self, PyObject *item)\r\n{\r\n    CHECK_VALID(NULL);\r\n    if (PyIndex_Check(item)) {\r\n        Py_ssize_t i = PyNumber_AsSsize_t(item, PyExc_IndexError);\r\n        if (i == -1 \u0026\u0026 PyErr_Occurred())\r\n            return NULL;\r\n        if (i \u003c 0)\r\n            i += self-\u003esize;\r\n        if (i \u003c 0 || i \u003e= self-\u003esize) {\r\n            PyErr_SetString(PyExc_IndexError,\r\n                \"mmap index out of range\");\r\n            return NULL;\r\n        }\r\n        return PyLong_FromLong(Py_CHARMASK(self-\u003edata[i]));\r\n...\r\n```\r\n\r\nthe `CHECK_VALID(NULL)` call which checks whether the mmap object is closed happens before the `PyNumber_AsSsize_t` call which closes the object (and similarly for the slice handling which happens further down).\n\n\u003c!-- gh-linked-prs --\u003e\n### Linked PRs\n* gh-103990\n* gh-104677\n\u003c!-- /gh-linked-prs --\u003e\n","author":{"url":"https://github.com/cfbolz","@type":"Person","name":"cfbolz"},"datePublished":"2023-04-29T10:20:08.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":9},"url":"https://github.com/103987/cpython/issues/103987"}