From a0ceb731fb8bbd4aeefdb25b7aa9d5fa7abed5f9 Mon Sep 17 00:00:00 2001 From: Antoine Pitrou Date: Thu, 6 Aug 2009 20:29:56 +0000 Subject: Merged revisions 74336 via svnmerge from svn+ssh://pythondev@svn.python.org/python/trunk MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ........ r74336 | antoine.pitrou | 2009-08-06 22:18:29 +0200 (jeu., 06 août 2009) | 8 lines Issue #6629: Fix a data corruption issue in the new `io` package, which could occur when writing to a BufferedRandom object (e.g. a file opened in "rb+" or "wb+" mode) after having buffered a certain amount of data for reading. This bug was not present in the pure Python implementation. Yes, this is a serious issue. ........ --- Modules/_io/bufferedio.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) (limited to 'Modules') diff --git a/Modules/_io/bufferedio.c b/Modules/_io/bufferedio.c index 98f8413b31..d8b6471fd7 100644 --- a/Modules/_io/bufferedio.c +++ b/Modules/_io/bufferedio.c @@ -1757,6 +1757,19 @@ bufferedwriter_write(buffered *self, PyObject *args) } Py_CLEAR(res); + /* Adjust the raw stream position if it is away from the logical stream + position. This happens if the read buffer has been filled but not + modified (and therefore _bufferedwriter_flush_unlocked() didn't rewind + the raw stream by itself). + Fixes issue #6629. + */ + n = RAW_OFFSET(self); + if (n != 0) { + if (_buffered_raw_seek(self, -n, 1) < 0) + goto error; + self->raw_pos -= n; + } + /* Then write buf itself. At this point the buffer has been emptied. */ remaining = buf.len; written = 0; -- cgit v1.2.1