[Python-checkins] r45532 - python/trunk/Lib/test/crashers/dictresize_attack.py

armin.rigo python-checkins at python.org
Tue Apr 18 16:00:02 CEST 2006


Author: armin.rigo
Date: Tue Apr 18 16:00:01 2006
New Revision: 45532

Added:
   python/trunk/Lib/test/crashers/dictresize_attack.py   (contents, props changed)
Log:
A dictresize() attack.  If oldtable == mp->ma_smalltable then pure
Python code can mangle with mp->ma_smalltable while it is being walked
over.


Added: python/trunk/Lib/test/crashers/dictresize_attack.py
==============================================================================
--- (empty file)
+++ python/trunk/Lib/test/crashers/dictresize_attack.py	Tue Apr 18 16:00:01 2006
@@ -0,0 +1,32 @@
+# http://www.python.org/sf/1456209
+
+# A dictresize() attack.  If oldtable == mp->ma_smalltable then pure
+# Python code can mangle with mp->ma_smalltable while it is being walked
+# over.
+
+class X(object):
+
+    def __hash__(self):
+        return 5
+
+    def __eq__(self, other):
+        if resizing:
+            d.clear()
+        return False
+
+
+d = {}
+
+resizing = False
+
+d[X()] = 1
+d[X()] = 2
+d[X()] = 3
+d[X()] = 4
+d[X()] = 5
+
+# now trigger a resize
+resizing = True
+d[9] = 6
+
+# ^^^ I get Segmentation fault or Illegal instruction here.


More information about the Python-checkins mailing list