summaryrefslogtreecommitdiffstats
path: root/Lib/test/crashers/loosing_mro_ref.py
blob: f0b8047d8d1972f0514fad39bbab75fbe2eda4eb (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
"""
There is a way to put keys of any type in a type's dictionary.
I think this allows various kinds of crashes, but so far I have only
found a convoluted attack of _PyType_Lookup(), which uses the mro of the
type without holding a strong reference to it.  Probably works with
super.__getattribute__() too, which uses the same kind of code.
"""

class MyKey(object):
    def __hash__(self):
        return hash('mykey')

    def __cmp__(self, other):
        # the following line decrefs the previous X.__mro__
        X.__bases__ = (Base2,)
        # trash all tuples of length 3, to make sure that the items of
        # the previous X.__mro__ are really garbage
        z = []
        for i in range(1000):
            z.append((i, None, None))
        return -1


class Base(object):
    mykey = 'from Base'

class Base2(object):
    mykey = 'from Base2'

class X(Base):
    # you can't add a non-string key to X.__dict__, but it can be
    # there from the beginning :-)
    locals()[MyKey()] = 5

print X.mykey
# I get a segfault, or a slightly wrong assertion error in a debug build.