[ 1497053 ] Let dicts propagate the exceptions in user __eq__().
[ 1456209 ] dictresize() vulnerability ( <- backport candidate ).
diff --git a/Lib/test/crashers/dictresize_attack.py b/Lib/test/crashers/dictresize_attack.py
deleted file mode 100644
index 1895791..0000000
--- a/Lib/test/crashers/dictresize_attack.py
+++ /dev/null
@@ -1,32 +0,0 @@
-# http://www.python.org/sf/1456209
-
-# A dictresize() attack. If oldtable == mp->ma_smalltable then pure
-# Python code can mangle with mp->ma_smalltable while it is being walked
-# over.
-
-class X(object):
-
- def __hash__(self):
- return 5
-
- def __eq__(self, other):
- if resizing:
- d.clear()
- return False
-
-
-d = {}
-
-resizing = False
-
-d[X()] = 1
-d[X()] = 2
-d[X()] = 3
-d[X()] = 4
-d[X()] = 5
-
-# now trigger a resize
-resizing = True
-d[9] = 6
-
-# ^^^ I get Segmentation fault or Illegal instruction here.
diff --git a/Lib/test/output/test_operations b/Lib/test/output/test_operations
index 32eff3f..8a1bc2a 100644
--- a/Lib/test/output/test_operations
+++ b/Lib/test/output/test_operations
@@ -1,6 +1,21 @@
test_operations
3. Operations
XXX Mostly not yet implemented
-3.1 Dictionary lookups succeed even if __cmp__() raises an exception
+3.1 Dictionary lookups fail if __cmp__() raises an exception
raising error
-No exception passed through.
+d[x2] = 2: caught the RuntimeError outside
+raising error
+z = d[x2]: caught the RuntimeError outside
+raising error
+x2 in d: caught the RuntimeError outside
+raising error
+d.has_key(x2): caught the RuntimeError outside
+raising error
+d.get(x2): caught the RuntimeError outside
+raising error
+d.setdefault(x2, 42): caught the RuntimeError outside
+raising error
+d.pop(x2): caught the RuntimeError outside
+raising error
+d.update({x2: 2}): caught the RuntimeError outside
+resize bugs not triggered.
diff --git a/Lib/test/test_operations.py b/Lib/test/test_operations.py
index b599c9d..fafc062 100644
--- a/Lib/test/test_operations.py
+++ b/Lib/test/test_operations.py
@@ -5,27 +5,16 @@
print 'XXX Mostly not yet implemented'
-print '3.1 Dictionary lookups succeed even if __cmp__() raises an exception'
-
-# SourceForge bug #112558:
-# http://sourceforge.net/bugs/?func=detailbug&bug_id=112558&group_id=5470
+print '3.1 Dictionary lookups fail if __cmp__() raises an exception'
class BadDictKey:
- already_printed_raising_error = 0
def __hash__(self):
return hash(self.__class__)
def __cmp__(self, other):
if isinstance(other, self.__class__):
- if not BadDictKey.already_printed_raising_error:
- # How many times __cmp__ gets called depends on the hash
- # code and the internals of the dict implementation; we
- # know it will be called at least once, but that's it.
- # already_printed_raising_error makes sure the expected-
- # output file prints the msg at most once.
- BadDictKey.already_printed_raising_error = 1
- print "raising error"
+ print "raising error"
raise RuntimeError, "gotcha"
return other
@@ -33,8 +22,21 @@
x1 = BadDictKey()
x2 = BadDictKey()
d[x1] = 1
-d[x2] = 2
-print "No exception passed through."
+for stmt in ['d[x2] = 2',
+ 'z = d[x2]',
+ 'x2 in d',
+ 'd.has_key(x2)',
+ 'd.get(x2)',
+ 'd.setdefault(x2, 42)',
+ 'd.pop(x2)',
+ 'd.update({x2: 2})']:
+ try:
+ exec stmt
+ except RuntimeError:
+ print "%s: caught the RuntimeError outside" % (stmt,)
+ else:
+ print "%s: No exception passed through!" # old CPython behavior
+
# Dict resizing bug, found by Jack Jansen in 2.2 CVS development.
# This version got an assert failure in debug build, infinite loop in
@@ -50,3 +52,27 @@
del d[i]
for i in range(5, 9): # i==8 was the problem
d[i] = i
+
+
+# Another dict resizing bug (SF bug #1456209).
+# This caused Segmentation faults or Illegal instructions.
+
+class X(object):
+ def __hash__(self):
+ return 5
+ def __eq__(self, other):
+ if resizing:
+ d.clear()
+ return False
+d = {}
+resizing = False
+d[X()] = 1
+d[X()] = 2
+d[X()] = 3
+d[X()] = 4
+d[X()] = 5
+# now trigger a resize
+resizing = True
+d[9] = 6
+
+print 'resize bugs not triggered.'