Issue #14211: Oops, I removed the wrong file :-)

This commit is contained in:
Victor Stinner 2012-03-09 00:52:07 +01:00
parent 2d01dc00bc
commit 40c9565bcc
2 changed files with 29 additions and 38 deletions

View File

@ -0,0 +1,29 @@
"""
_PyType_Lookup() returns a borrowed reference.
This attacks the call in dictobject.c.
"""
class A(object):
pass
class B(object):
def __del__(self):
print('hi')
del D.__missing__
class D(dict):
class __missing__:
def __init__(self, *args):
pass
d = D()
a = A()
a.cycle = a
a.other = B()
del a
prev = None
while 1:
d[5]
prev = (prev,)

View File

@ -1,38 +0,0 @@
"""
_PyType_Lookup() returns a borrowed reference.
This attacks PyObject_GenericSetAttr().
NB. on my machine this crashes in 2.5 debug but not release.
"""
class A(object):
pass
class B(object):
def __del__(self):
print("hi")
del C.d
class D(object):
def __set__(self, obj, value):
self.hello = 42
class C(object):
d = D()
def g():
pass
c = C()
a = A()
a.cycle = a
a.other = B()
lst = [None] * 1000000
i = 0
del a
while 1:
c.d = 42 # segfaults in PyMethod_New(__func__=D.__set__, __self__=d)
lst[i] = c.g # consume the free list of instancemethod objects
i += 1