From 337841dac7f1936c78bacf60c88e085e7ca6231d Mon Sep 17 00:00:00 2001 From: Armin Rigo Date: Thu, 6 Sep 2007 09:30:38 +0000 Subject: PyDict_GetItem() returns a borrowed reference. This attack is against ceval.c:IMPORT_NAME, which calls an object (__builtin__.__import__) without holding a reference to it. --- Lib/test/crashers/borrowed_ref_4.py | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) create mode 100644 Lib/test/crashers/borrowed_ref_4.py diff --git a/Lib/test/crashers/borrowed_ref_4.py b/Lib/test/crashers/borrowed_ref_4.py new file mode 100644 index 0000000..d1fd8aa --- /dev/null +++ b/Lib/test/crashers/borrowed_ref_4.py @@ -0,0 +1,28 @@ +""" +PyDict_GetItem() returns a borrowed reference. +This attack is against ceval.c:IMPORT_NAME, which calls an +object (__builtin__.__import__) without holding a reference to it. +""" + +import types +import __builtin__ + + +class X(object): + def __getattr__(self, name): + # this is called with name == '__bases__' by PyObject_IsInstance() + # during the unbound method call -- it frees the unbound method + # itself before it invokes its im_func. + del __builtin__.__import__ + return () + +pseudoclass = X() + +class Y(object): + def __call__(self, *args): + # 'self' was freed already + print self, args + +# make an unbound method +__builtin__.__import__ = types.MethodType(Y(), None, (pseudoclass, str)) +import spam -- cgit v0.12