collected my segfaulting Python examples from the SF trackers

(is the purpose of the crashers directory to scare people? :-)

8 files changed, 99 insertions, 0 deletions

diff --git a/Lib/test/crashers/dangerous_subclassing.py b/Lib/test/crashers/dangerous_subclassing.py
new file mode 100644
index 0000000..0479952
--- /dev/null
+++ b/Lib/test/crashers/dangerous_subclassing.py
@@ -0,0 +1,12 @@
+
+# http://python.org/sf/1174712
+
+import types
+
+class X(types.ModuleType, str):
+    """Such a subclassing is incorrectly allowed --
+    see the SF bug report for explanations"""
+
+if __name__ == '__main__':
+    X('name')    # segfault: ModuleType.__init__() reads
+                 # the dict at the wrong offset
diff --git a/Lib/test/crashers/infinite_rec_1.py b/Lib/test/crashers/infinite_rec_1.py
new file mode 100644
index 0000000..573a509
--- /dev/null
+++ b/Lib/test/crashers/infinite_rec_1.py
@@ -0,0 +1,11 @@
+
+# http://python.org/sf/1202533
+
+import new, operator
+
+class A:
+    pass
+A.__mul__ = new.instancemethod(operator.mul, None, A)
+
+if __name__ == '__main__':
+    A()*2   # segfault: infinite recursion in C
diff --git a/Lib/test/crashers/infinite_rec_2.py b/Lib/test/crashers/infinite_rec_2.py
new file mode 100644
index 0000000..5a14b33
--- /dev/null
+++ b/Lib/test/crashers/infinite_rec_2.py
@@ -0,0 +1,10 @@
+
+# http://python.org/sf/1202533
+
+class A(str):
+    __get__ = getattr
+
+if __name__ == '__main__':
+    a = A('a')
+    A.a = a
+    a.a   # segfault: infinite recursion in C
diff --git a/Lib/test/crashers/infinite_rec_3.py b/Lib/test/crashers/infinite_rec_3.py
new file mode 100644
index 0000000..0b04e4c
--- /dev/null
+++ b/Lib/test/crashers/infinite_rec_3.py
@@ -0,0 +1,9 @@
+
+# http://python.org/sf/1202533
+
+class A(object):
+    pass
+A.__call__ = A()
+
+if __name__ == '__main__':
+    A()()   # segfault: infinite recursion in C
diff --git a/Lib/test/crashers/infinite_rec_4.py b/Lib/test/crashers/infinite_rec_4.py
new file mode 100644
index 0000000..14f1520
--- /dev/null
+++ b/Lib/test/crashers/infinite_rec_4.py
@@ -0,0 +1,7 @@
+
+# http://python.org/sf/1202533
+
+if __name__ == '__main__':
+    lst = [apply]
+    lst.append(lst)
+    apply(*lst)      # segfault: infinite recursion in C
diff --git a/Lib/test/crashers/infinite_rec_5.py b/Lib/test/crashers/infinite_rec_5.py
new file mode 100644
index 0000000..18d2963
--- /dev/null
+++ b/Lib/test/crashers/infinite_rec_5.py
@@ -0,0 +1,10 @@
+
+# http://python.org/sf/1267884
+
+import types
+
+class C:
+    __str__ = types.InstanceType.__str__
+
+if __name__ == '__main__':
+    str(C())   # segfault: infinite recursion in C
diff --git a/Lib/test/crashers/loosing_dict_ref.py b/Lib/test/crashers/loosing_dict_ref.py
new file mode 100644
index 0000000..f44370b
--- /dev/null
+++ b/Lib/test/crashers/loosing_dict_ref.py
@@ -0,0 +1,21 @@
+
+# http://python.org/sf/1303614
+
+class Strange(object):
+    def __hash__(self):
+        return hash('hello')
+
+    def __eq__(self, other):
+        x.__dict__ = {}   # the old x.__dict__ is deallocated
+        return False
+
+
+class X(object):
+    pass
+
+if __name__ == '__main__':
+    v = 123
+    x = X()
+    x.__dict__ = {Strange(): 42,
+                  'hello': v+456}
+    x.hello  # segfault: the above dict is accessed after it's deallocated
diff --git a/Lib/test/crashers/modify_dict_attr.py b/Lib/test/crashers/modify_dict_attr.py
new file mode 100644
index 0000000..dfce467
--- /dev/null
+++ b/Lib/test/crashers/modify_dict_attr.py
@@ -0,0 +1,19 @@
+
+# http://python.org/sf/1303614
+
+class Y(object):
+    pass
+
+class type_with_modifiable_dict(Y, type):
+    pass
+
+class MyClass(object):
+    """This class has its __dict__ attribute completely exposed:
+    user code can read, reassign and even delete it.
+    """
+    __metaclass__ = type_with_modifiable_dict
+
+
+if __name__ == '__main__':
+    del MyClass.__dict__  # if we set tp_dict to NULL,
+    print MyClass         # doing anything with MyClass segfaults