diff options
| author | Barry Warsaw <barry@python.org> | 2012-02-21 01:42:21 (GMT) |
|---|---|---|
| committer | Barry Warsaw <barry@python.org> | 2012-02-21 01:42:21 (GMT) |
| commit | 1e13eb084f72d5993cbb726e45b36bdb69c83a24 (patch) | |
| tree | 1db691c15c5980a870bcc2606a6d2afc77e28bad /Modules/main.c | |
| parent | f5a5beb33985b4b55480de267084b90d89a5c5c4 (diff) | |
| download | cpython-1e13eb084f72d5993cbb726e45b36bdb69c83a24.zip cpython-1e13eb084f72d5993cbb726e45b36bdb69c83a24.tar.gz cpython-1e13eb084f72d5993cbb726e45b36bdb69c83a24.tar.bz2 | |
- Issue #13703: oCERT-2011-003: add -R command-line option and PYTHONHASHSEED
environment variable, to provide an opt-in way to protect against denial of
service attacks due to hash collisions within the dict and set types. Patch
by David Malcolm, based on work by Victor Stinner.
Diffstat (limited to 'Modules/main.c')
| -rw-r--r-- | Modules/main.c | 16 |
1 files changed, 15 insertions, 1 deletions
diff --git a/Modules/main.c b/Modules/main.c index dd196ef..a57d00b 100644 --- a/Modules/main.c +++ b/Modules/main.c @@ -40,7 +40,7 @@ static char **orig_argv; static int orig_argc; /* command line options */ -#define BASE_OPTS "3bBc:dEhiJm:OQ:sStuUvVW:xX?" +#define BASE_OPTS "3bBc:dEhiJm:OQ:RsStuUvVW:xX?" #ifndef RISCOS #define PROGRAM_OPTS BASE_OPTS @@ -71,6 +71,9 @@ static char *usage_2 = "\ -m mod : run library module as a script (terminates option list)\n\ -O : optimize generated bytecode slightly; also PYTHONOPTIMIZE=x\n\ -OO : remove doc-strings in addition to the -O optimizations\n\ +-R : use a pseudo-random salt to make hash() values of various types be\n\ + unpredictable between separate invocations of the interpreter, as\n\ + a defense against denial-of-service attacks\n\ -Q arg : division options: -Qold (default), -Qwarn, -Qwarnall, -Qnew\n\ -s : don't add user site directory to sys.path; also PYTHONNOUSERSITE\n\ -S : don't imply 'import site' on initialization\n\ @@ -101,6 +104,12 @@ PYTHONHOME : alternate <prefix> directory (or <prefix>%c<exec_prefix>).\n\ PYTHONCASEOK : ignore case in 'import' statements (Windows).\n\ PYTHONIOENCODING: Encoding[:errors] used for stdin/stdout/stderr.\n\ "; +static char *usage_6 = "\ +PYTHONHASHSEED: if this variable is set to ``random``, the effect is the same \n\ + as specifying the :option:`-R` option: a random value is used to seed the\n\ + hashes of str, bytes and datetime objects. It can also be set to an integer\n\ + in the range [0,4294967295] to get hash values with a predictable seed.\n\ +"; static int @@ -117,6 +126,7 @@ usage(int exitcode, char* program) fputs(usage_3, f); fprintf(f, usage_4, DELIM); fprintf(f, usage_5, DELIM, PYTHONHOMEHELP); + fputs(usage_6, f); } #if defined(__VMS) if (exitcode == 0) { @@ -388,6 +398,10 @@ Py_Main(int argc, char **argv) PySys_AddWarnOption(_PyOS_optarg); break; + case 'R': + Py_HashRandomizationFlag++; + break; + /* This space reserved for other options */ default: |