From: Armin Rigo Date: Thu, 6 Sep 2007 09:30:38 +0000 (+0000) Subject: PyDict_GetItem() returns a borrowed reference. X-Git-Tag: v2.6a1~1339 X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=337841dac7f1936c78bacf60c88e085e7ca6231d;p=python PyDict_GetItem() returns a borrowed reference. This attack is against ceval.c:IMPORT_NAME, which calls an object (__builtin__.__import__) without holding a reference to it. --- diff --git a/Lib/test/crashers/borrowed_ref_4.py b/Lib/test/crashers/borrowed_ref_4.py new file mode 100644 index 0000000000..d1fd8aad3a --- /dev/null +++ b/Lib/test/crashers/borrowed_ref_4.py @@ -0,0 +1,28 @@ +""" +PyDict_GetItem() returns a borrowed reference. +This attack is against ceval.c:IMPORT_NAME, which calls an +object (__builtin__.__import__) without holding a reference to it. +""" + +import types +import __builtin__ + + +class X(object): + def __getattr__(self, name): + # this is called with name == '__bases__' by PyObject_IsInstance() + # during the unbound method call -- it frees the unbound method + # itself before it invokes its im_func. + del __builtin__.__import__ + return () + +pseudoclass = X() + +class Y(object): + def __call__(self, *args): + # 'self' was freed already + print self, args + +# make an unbound method +__builtin__.__import__ = types.MethodType(Y(), None, (pseudoclass, str)) +import spam