Merge fix for issue #11391

Author: pitrou

Lib/test/test_mmap.py

@@ -234,6 +234,14 @@ def test_access_parameter(self):
                                   flags=mmap.MAP_PRIVATE,
                                   prot=mmap.PROT_READ, access=mmap.ACCESS_WRITE)
 
+            # Try writing with PROT_EXEC and without PROT_WRITE
+            prot = mmap.PROT_READ | getattr(mmap, 'PROT_EXEC', 0)
+            with open(TESTFN, "r+b") as f:
+                m = mmap.mmap(f.fileno(), mapsize, prot=prot)
+                self.assertRaises(TypeError, m.write, b"abcdef")
+                self.assertRaises(TypeError, m.write_byte, 0)
+                m.close()
+
     def test_bad_file_desc(self):
         # Try opening a bad file descriptor...
         self.assertRaises(mmap.error, mmap.mmap, -2, 4096)

Misc/NEWS

@@ -55,6 +55,10 @@ Core and Builtins
 Library
 -------
 
+- Issue #11391: Writing to a mmap object created with
+  ``mmap.PROT_READ|mmap.PROT_EXEC`` would segfault instead of raising a
+  TypeError.  Patch by Charles-François Natali.
+
 - Issue #9795: add context manager protocol support for nntplib.NNTP class.
 
 - Issue #11306: mailbox in certain cases adapts to an inability to open

Modules/mmapmodule.c

@@ -1106,17 +1106,22 @@ new_mmap_object(PyTypeObject *type, PyObject *args, PyObject *kwdict)
         prot = PROT_READ | PROT_WRITE;
         break;
     case ACCESS_DEFAULT:
-        /* use the specified or default values of flags and prot */
+        /* map prot to access type */
+        if ((prot & PROT_READ) && (prot & PROT_WRITE)) {
+            /* ACCESS_DEFAULT */
+        }
+        else if (prot & PROT_WRITE) {
+            access = ACCESS_WRITE;
+        }
+        else {
+            access = ACCESS_READ;
+        }
         break;
     default:
         return PyErr_Format(PyExc_ValueError,
                             "mmap invalid access parameter.");
     }
 
-    if (prot == PROT_READ) {
-    access = ACCESS_READ;
-    }
-
 #ifdef HAVE_FSTAT
 #  ifdef __VMS
     /* on OpenVMS we must ensure that all bytes are written to the file */