cpython/Lib/test/crashers/decref_before_assignment.py

45 lines
1020 B
Python

"""
General example for an attack against code like this:
Py_DECREF(obj->attr); obj->attr = ...;
here in Module/_json.c:scanner_init().
Explanation: if the first Py_DECREF() calls either a __del__ or a
weakref callback, it will run while the 'obj' appears to have in
'obj->attr' still the old reference to the object, but not holding
the reference count any more.
Status: progress has been made replacing these cases, but there is an
infinite number of such cases.
"""
import _json, weakref
class Ctx1(object):
encoding = "utf8"
strict = None
object_hook = None
object_pairs_hook = None
parse_float = None
parse_int = None
parse_constant = None
class Foo(unicode):
pass
def delete_me(*args):
print scanner.encoding.__dict__
class Ctx2(Ctx1):
@property
def encoding(self):
global wref
f = Foo("utf8")
f.abc = globals()
wref = weakref.ref(f, delete_me)
return f
scanner = _json.make_scanner(Ctx1())
scanner.__init__(Ctx2())