cpython: 2cc44cd8098e (original) (raw)

Mercurial > cpython

changeset 75499:2cc44cd8098e

Issue #14211: Oops, I removed the wrong file :-) [#14211]

Victor Stinner victor.stinner@gmail.com
date	Fri, 09 Mar 2012 00:52:07 +0100
parents	579f845ac396
children	3d877dee1bde
files	Lib/test/crashers/borrowed_ref_1.py Lib/test/crashers/borrowed_ref_2.py
diffstat	2 files changed, 29 insertions(+), 38 deletions(-)[+] [-] Lib/test/crashers/borrowed_ref_1.py 29 Lib/test/crashers/borrowed_ref_2.py 38

line wrap: on

line diff

new file mode 100644 --- /dev/null +++ b/Lib/test/crashers/borrowed_ref_1.py @@ -0,0 +1,29 @@ +""" +_PyType_Lookup() returns a borrowed reference. +This attacks the call in dictobject.c. +""" + +class A(object):

pass

+ +class B(object):

def del(self):
```
   print('hi')[](#l1.15)
```
```
   del D.__missing__[](#l1.16)
```

+ +class D(dict):

class missing:
```
   def __init__(self, *args):[](#l1.20)
```
```
       pass[](#l1.21)
```

+ + +d = D() +a = A() +a.cycle = a +a.other = B() +del a + +prev = None +while 1:

d[5]
prev = (prev,)

deleted file mode 100644 --- a/Lib/test/crashers/borrowed_ref_2.py +++ /dev/null @@ -1,38 +0,0 @@ -""" -_PyType_Lookup() returns a borrowed reference. -This attacks PyObject_GenericSetAttr(). - -NB. on my machine this crashes in 2.5 debug but not release. -""" - -class A(object):

pass

- -class B(object):

def del(self):
```
   print("hi")[](#l2.17)
```
```
   del C.d[](#l2.18)
```

- -class D(object):

def set(self, obj, value):
```
   self.hello = 42[](#l2.22)
```

- -class C(object):

d = D()

def g():
```
   pass[](#l2.28)
```

- - -c = C() -a = A() -a.cycle = a -a.other = B() - -lst = [None] * 1000000 -i = 0 -del a -while 1:

c.d = 42 # segfaults in PyMethod_New(func=D.set, self=d)
lst[i] = c.g # consume the free list of instancemethod objects
i += 1