Fix SF #441664: Python crash on del of a slice of a mmap

Check for slice/item deletion, which calls slice/item assignment with a NULL
value, and raise a TypeError instead of coredumping. Bugreport and suggested
fix by Alex Martelli.

1 files changed, 10 insertions, 0 deletions

diff --git a/Modules/mmapmodule.c b/Modules/mmapmodule.c
index 63ef72a7f3..d5bc89f309 100644
--- a/Modules/mmapmodule.c
+++ b/Modules/mmapmodule.c
@@ -663,6 +663,11 @@ mmap_ass_slice(mmap_object *self, int ilow, int ihigh, PyObject *v)
 	else if ((size_t)ihigh > self->size)
 		ihigh = self->size;
     
+	if (v == NULL) {
+		PyErr_SetString(PyExc_TypeError,
+			"mmap object doesn't support slice deletion");
+		return -1;
+	}
 	if (! (PyString_Check(v)) ) {
 		PyErr_SetString(PyExc_IndexError, 
 				"mmap slice assignment must be a string");
@@ -688,6 +693,11 @@ mmap_ass_item(mmap_object *self, int i, PyObject *v)
 		PyErr_SetString(PyExc_IndexError, "mmap index out of range");
 		return -1;
 	}
+	if (v == NULL) {
+		PyErr_SetString(PyExc_TypeError,
+			"mmap object doesn't support item deletion");
+		return -1;
+	}
 	if (! (PyString_Check(v) && PyString_Size(v)==1) ) {
 		PyErr_SetString(PyExc_IndexError, 
 			"mmap assignment must be single-character string");