From: Armin Rigo <arigo@tunes.org>
Date: Sat, 14 Jan 2006 10:58:30 +0000 (+0000)
Subject: collected my segfaulting Python examples from the SF trackers
X-Git-Tag: v2.5a0~828
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=b4b5a7601b72ab43cb9f5a0f6b9ab33776b2e16d;p=python

collected my segfaulting Python examples from the SF trackers
(is the purpose of the crashers directory to scare people? :-)
---

diff --git a/Lib/test/crashers/dangerous_subclassing.py b/Lib/test/crashers/dangerous_subclassing.py
new file mode 100644
index 0000000000..0479952b2c
--- /dev/null
+++ b/Lib/test/crashers/dangerous_subclassing.py
@@ -0,0 +1,12 @@
+
+# http://python.org/sf/1174712
+
+import types
+
+class X(types.ModuleType, str):
+    """Such a subclassing is incorrectly allowed --
+    see the SF bug report for explanations"""
+
+if __name__ == '__main__':
+    X('name')    # segfault: ModuleType.__init__() reads
+                 # the dict at the wrong offset
diff --git a/Lib/test/crashers/infinite_rec_1.py b/Lib/test/crashers/infinite_rec_1.py
new file mode 100644
index 0000000000..573a509b5f
--- /dev/null
+++ b/Lib/test/crashers/infinite_rec_1.py
@@ -0,0 +1,11 @@
+
+# http://python.org/sf/1202533
+
+import new, operator
+
+class A:
+    pass
+A.__mul__ = new.instancemethod(operator.mul, None, A)
+
+if __name__ == '__main__':
+    A()*2   # segfault: infinite recursion in C
diff --git a/Lib/test/crashers/infinite_rec_2.py b/Lib/test/crashers/infinite_rec_2.py
new file mode 100644
index 0000000000..5a14b33eaa
--- /dev/null
+++ b/Lib/test/crashers/infinite_rec_2.py
@@ -0,0 +1,10 @@
+
+# http://python.org/sf/1202533
+
+class A(str):
+    __get__ = getattr
+
+if __name__ == '__main__':
+    a = A('a')
+    A.a = a
+    a.a   # segfault: infinite recursion in C
diff --git a/Lib/test/crashers/infinite_rec_3.py b/Lib/test/crashers/infinite_rec_3.py
new file mode 100644
index 0000000000..0b04e4cbba
--- /dev/null
+++ b/Lib/test/crashers/infinite_rec_3.py
@@ -0,0 +1,9 @@
+
+# http://python.org/sf/1202533
+
+class A(object):
+    pass
+A.__call__ = A()
+
+if __name__ == '__main__':
+    A()()   # segfault: infinite recursion in C
diff --git a/Lib/test/crashers/infinite_rec_4.py b/Lib/test/crashers/infinite_rec_4.py
new file mode 100644
index 0000000000..14f15208e7
--- /dev/null
+++ b/Lib/test/crashers/infinite_rec_4.py
@@ -0,0 +1,7 @@
+
+# http://python.org/sf/1202533
+
+if __name__ == '__main__':
+    lst = [apply]
+    lst.append(lst)
+    apply(*lst)      # segfault: infinite recursion in C
diff --git a/Lib/test/crashers/infinite_rec_5.py b/Lib/test/crashers/infinite_rec_5.py
new file mode 100644
index 0000000000..18d2963233
--- /dev/null
+++ b/Lib/test/crashers/infinite_rec_5.py
@@ -0,0 +1,10 @@
+
+# http://python.org/sf/1267884
+
+import types
+
+class C:
+    __str__ = types.InstanceType.__str__
+
+if __name__ == '__main__':
+    str(C())   # segfault: infinite recursion in C
diff --git a/Lib/test/crashers/loosing_dict_ref.py b/Lib/test/crashers/loosing_dict_ref.py
new file mode 100644
index 0000000000..f44370b9a5
--- /dev/null
+++ b/Lib/test/crashers/loosing_dict_ref.py
@@ -0,0 +1,21 @@
+
+# http://python.org/sf/1303614
+
+class Strange(object):
+    def __hash__(self):
+        return hash('hello')
+
+    def __eq__(self, other):
+        x.__dict__ = {}   # the old x.__dict__ is deallocated
+        return False
+
+
+class X(object):
+    pass
+
+if __name__ == '__main__':
+    v = 123
+    x = X()
+    x.__dict__ = {Strange(): 42,
+                  'hello': v+456}
+    x.hello  # segfault: the above dict is accessed after it's deallocated
diff --git a/Lib/test/crashers/modify_dict_attr.py b/Lib/test/crashers/modify_dict_attr.py
new file mode 100644
index 0000000000..dfce467c8e
--- /dev/null
+++ b/Lib/test/crashers/modify_dict_attr.py
@@ -0,0 +1,19 @@
+
+# http://python.org/sf/1303614
+
+class Y(object):
+    pass
+
+class type_with_modifiable_dict(Y, type):
+    pass
+
+class MyClass(object):
+    """This class has its __dict__ attribute completely exposed:
+    user code can read, reassign and even delete it.
+    """
+    __metaclass__ = type_with_modifiable_dict
+
+
+if __name__ == '__main__':
+    del MyClass.__dict__  # if we set tp_dict to NULL,
+    print MyClass         # doing anything with MyClass segfaults