<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
<title></title>
</head>
<body bgcolor="#ffffff" text="#000000">
<br>
Guido van Rossum wrote:
<blockquote
cite="mid:ca471dc20904011653s212fb43m9c93fc4dfb966c25@mail.gmail.com"
type="cite">
<pre wrap="">This is a bug in cPickle. It calls the PycString_IMPORT macro at the
very end of its init_stuff() function without checking for success.
</pre>
</blockquote>
<br>
The bug you cite is a genuine bug, but that's not what I'm exploiting.<br>
<br>
% python<br>
>>> import _socket<br>
>>> _socket.CAPI<br>
<PyCObject object at 0xb7d5b500><br>
<br>
The PyCObject_Import() call in PycString_IMPORT doesn't return
failure--it returns a valid CObject. I stuck the *wrong* CObject in
cStringIO on purpose. With the current API there's no way for cPickle
to tell that it's using the wrong one.<br>
<br>
For what it's worth, the previous example was for Python 2.x. (Python
3 doesn't have "cStringIO" or "cPickle".) Here's an example that
crashes python in my py3k/trunk (sync'd Monday morning). And this
one's only three lines:<br>
<blockquote>import unicodedata<br>
import _multibytecodec<br>
_multibytecodec.__create_codec(unicodedata.ucnhash_CAPI)<br>
</blockquote>
<br>
<br>
/larry/
</body>
</html>