From: Armin Rigo Date: Mon, 25 Sep 2006 15:16:26 +0000 (+0000) Subject: Another crasher. X-Git-Tag: v2.6a1~2636 X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=c839c2f2262cc95e1831ad514f52abd8128367da;p=python Another crasher. --- diff --git a/Lib/test/crashers/loosing_mro_ref.py b/Lib/test/crashers/loosing_mro_ref.py new file mode 100644 index 0000000000..f0b8047d8d --- /dev/null +++ b/Lib/test/crashers/loosing_mro_ref.py @@ -0,0 +1,36 @@ +""" +There is a way to put keys of any type in a type's dictionary. +I think this allows various kinds of crashes, but so far I have only +found a convoluted attack of _PyType_Lookup(), which uses the mro of the +type without holding a strong reference to it. Probably works with +super.__getattribute__() too, which uses the same kind of code. +""" + +class MyKey(object): + def __hash__(self): + return hash('mykey') + + def __cmp__(self, other): + # the following line decrefs the previous X.__mro__ + X.__bases__ = (Base2,) + # trash all tuples of length 3, to make sure that the items of + # the previous X.__mro__ are really garbage + z = [] + for i in range(1000): + z.append((i, None, None)) + return -1 + + +class Base(object): + mykey = 'from Base' + +class Base2(object): + mykey = 'from Base2' + +class X(Base): + # you can't add a non-string key to X.__dict__, but it can be + # there from the beginning :-) + locals()[MyKey()] = 5 + +print X.mykey +# I get a segfault, or a slightly wrong assertion error in a debug build.