+++ /dev/null
-"""\r
-There is a way to put keys of any type in a type's dictionary.\r
-I think this allows various kinds of crashes, but so far I have only\r
-found a convoluted attack of _PyType_Lookup(), which uses the mro of the\r
-type without holding a strong reference to it. Probably works with\r
-super.__getattribute__() too, which uses the same kind of code.\r
-"""\r
-\r
-class MyKey(object):\r
- def __hash__(self):\r
- return hash('mykey')\r
-\r
- def __cmp__(self, other):\r
- # the following line decrefs the previous X.__mro__\r
- X.__bases__ = (Base2,)\r
- # trash all tuples of length 3, to make sure that the items of\r
- # the previous X.__mro__ are really garbage\r
- z = []\r
- for i in range(1000):\r
- z.append((i, None, None))\r
- return -1\r
-\r
-\r
-class Base(object):\r
- mykey = 'from Base'\r
-\r
-class Base2(object):\r
- mykey = 'from Base2'\r
-\r
-# you can't add a non-string key to X.__dict__, but it can be\r
-# there from the beginning :-)\r
-X = type('X', (Base,), {MyKey(): 5})\r
-\r
-print X.mykey\r
-# I get a segfault, or a slightly wrong assertion error in a debug build.\r