PyDict_GetItem() returns a borrowed reference.

There are probably a number of places that are open to attacks
such as the following one, in bltinmodule.c:min_max().

1 files changed, 14 insertions, 0 deletions

diff --git a/Lib/test/crashers/borrowed_ref_3.py b/Lib/test/crashers/borrowed_ref_3.py
new file mode 100644
index 0000000..f241108
--- /dev/null
+++ b/Lib/test/crashers/borrowed_ref_3.py
@@ -0,0 +1,14 @@
+"""
+PyDict_GetItem() returns a borrowed reference.
+There are probably a number of places that are open to attacks
+such as the following one, in bltinmodule.c:min_max().
+"""
+
+class KeyFunc(object):
+    def __call__(self, n):
+        del d['key']
+        return 1
+
+
+d = {'key': KeyFunc()}
+min(range(10), **d)