mmap: do all internal arithmetic with Py_ssize_t while being very careful about overflow

Lib/test/test_mmap.py

@@ -652,6 +652,16 @@ class MmapTests(unittest.TestCase):
         finally:
             s.close()
 
+    def test_resize_past_pos(self):
+        m = mmap.mmap(-1, 8192)
+        self.addCleanup(m.close)
+        m.read(5000)
+        m.resize(4096)
+        self.assertEqual(m.read(14), '')
+        self.assertRaises(ValueError, m.read_byte,)
+        self.assertRaises(ValueError, m.write_byte, 'b')
+        self.assertRaises(ValueError, m.write, 'abc')
+
 
 class LargeMmapTests(unittest.TestCase):
 

Misc/NEWS

@@ -46,6 +46,9 @@ Core and Builtins
 Library
 -------
 
+- Fix possible integer overflows and crashes in the mmap module with unusual
+  usage patterns.
+
 - Issue #27897: Fixed possible crash in sqlite3.Connection.create_collation()
   if pass invalid string-like object as a name.  Original patch by Xiang Zhang.