From 0b2b583ea23a699ecb4f403f7547fbbac21dd2e7 Mon Sep 17 00:00:00 2001 From: Georg Brandl Date: Sun, 4 Mar 2012 20:36:28 +0100 Subject: Fix spelling. --- Lib/test/crashers/loosing_mro_ref.py | 35 ----------------------------------- Lib/test/crashers/losing_mro_ref.py | 35 +++++++++++++++++++++++++++++++++++ 2 files changed, 35 insertions(+), 35 deletions(-) delete mode 100644 Lib/test/crashers/loosing_mro_ref.py create mode 100644 Lib/test/crashers/losing_mro_ref.py diff --git a/Lib/test/crashers/loosing_mro_ref.py b/Lib/test/crashers/loosing_mro_ref.py deleted file mode 100644 index b3bcd32..0000000 --- a/Lib/test/crashers/loosing_mro_ref.py +++ /dev/null @@ -1,35 +0,0 @@ -""" -There is a way to put keys of any type in a type's dictionary. -I think this allows various kinds of crashes, but so far I have only -found a convoluted attack of _PyType_Lookup(), which uses the mro of the -type without holding a strong reference to it. Probably works with -super.__getattribute__() too, which uses the same kind of code. -""" - -class MyKey(object): - def __hash__(self): - return hash('mykey') - - def __eq__(self, other): - # the following line decrefs the previous X.__mro__ - X.__bases__ = (Base2,) - # trash all tuples of length 3, to make sure that the items of - # the previous X.__mro__ are really garbage - z = [] - for i in range(1000): - z.append((i, None, None)) - return 0 - - -class Base(object): - mykey = 'from Base' - -class Base2(object): - mykey = 'from Base2' - -# you can't add a non-string key to X.__dict__, but it can be -# there from the beginning :-) -X = type('X', (Base,), {MyKey(): 5}) - -print(X.mykey) -# I get a segfault, or a slightly wrong assertion error in a debug build. diff --git a/Lib/test/crashers/losing_mro_ref.py b/Lib/test/crashers/losing_mro_ref.py new file mode 100644 index 0000000..b3bcd32 --- /dev/null +++ b/Lib/test/crashers/losing_mro_ref.py @@ -0,0 +1,35 @@ +""" +There is a way to put keys of any type in a type's dictionary. +I think this allows various kinds of crashes, but so far I have only +found a convoluted attack of _PyType_Lookup(), which uses the mro of the +type without holding a strong reference to it. Probably works with +super.__getattribute__() too, which uses the same kind of code. +""" + +class MyKey(object): + def __hash__(self): + return hash('mykey') + + def __eq__(self, other): + # the following line decrefs the previous X.__mro__ + X.__bases__ = (Base2,) + # trash all tuples of length 3, to make sure that the items of + # the previous X.__mro__ are really garbage + z = [] + for i in range(1000): + z.append((i, None, None)) + return 0 + + +class Base(object): + mykey = 'from Base' + +class Base2(object): + mykey = 'from Base2' + +# you can't add a non-string key to X.__dict__, but it can be +# there from the beginning :-) +X = type('X', (Base,), {MyKey(): 5}) + +print(X.mykey) +# I get a segfault, or a slightly wrong assertion error in a debug build. -- cgit v0.12