| Armin Rigo | c839c2f | 2006-09-25 15:16:26 +0000 | [diff] [blame] | 1 | """ |
| 2 | There is a way to put keys of any type in a type's dictionary. |
| 3 | I think this allows various kinds of crashes, but so far I have only |
| 4 | found a convoluted attack of _PyType_Lookup(), which uses the mro of the |
| 5 | type without holding a strong reference to it. Probably works with |
| 6 | super.__getattribute__() too, which uses the same kind of code. |
| 7 | """ |
| 8 | |
| 9 | class MyKey(object): |
| 10 | def __hash__(self): |
| 11 | return hash('mykey') |
| 12 | |
| 13 | def __cmp__(self, other): |
| 14 | # the following line decrefs the previous X.__mro__ |
| 15 | X.__bases__ = (Base2,) |
| 16 | # trash all tuples of length 3, to make sure that the items of |
| 17 | # the previous X.__mro__ are really garbage |
| 18 | z = [] |
| 19 | for i in range(1000): |
| 20 | z.append((i, None, None)) |
| 21 | return -1 |
| 22 | |
| 23 | |
| 24 | class Base(object): |
| 25 | mykey = 'from Base' |
| 26 | |
| 27 | class Base2(object): |
| 28 | mykey = 'from Base2' |
| 29 | |
| 30 | class X(Base): |
| 31 | # you can't add a non-string key to X.__dict__, but it can be |
| 32 | # there from the beginning :-) |
| 33 | locals()[MyKey()] = 5 |
| 34 | |
| 35 | print X.mykey |
| 36 | # I get a segfault, or a slightly wrong assertion error in a debug build. |