From: Armin Rigo <arigo@tunes.org>
Date: Thu, 6 Sep 2007 09:30:38 +0000 (+0000)
Subject: PyDict_GetItem() returns a borrowed reference.
X-Git-Tag: v2.6a1~1339
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=337841dac7f1936c78bacf60c88e085e7ca6231d;p=python

PyDict_GetItem() returns a borrowed reference.
This attack is against ceval.c:IMPORT_NAME, which calls an
object (__builtin__.__import__) without holding a reference to it.
---

diff --git a/Lib/test/crashers/borrowed_ref_4.py b/Lib/test/crashers/borrowed_ref_4.py
new file mode 100644
index 0000000000..d1fd8aad3a
--- /dev/null
+++ b/Lib/test/crashers/borrowed_ref_4.py
@@ -0,0 +1,28 @@
+"""
+PyDict_GetItem() returns a borrowed reference.
+This attack is against ceval.c:IMPORT_NAME, which calls an
+object (__builtin__.__import__) without holding a reference to it.
+"""
+
+import types
+import __builtin__
+
+
+class X(object):
+    def __getattr__(self, name):
+        # this is called with name == '__bases__' by PyObject_IsInstance()
+        # during the unbound method call -- it frees the unbound method
+        # itself before it invokes its im_func.
+        del __builtin__.__import__
+        return ()
+
+pseudoclass = X()
+
+class Y(object):
+    def __call__(self, *args):
+        # 'self' was freed already
+        print self, args
+
+# make an unbound method
+__builtin__.__import__ = types.MethodType(Y(), None, (pseudoclass, str))
+import spam