New submission from Amaury Forgeot d'Arc:
The following script exploits a comment in funcobject.c:
/* XXX This is broken if the caller deletes dict items! */
Because the code only borrows references to the items, it is possible to
have them destroyed before they are copied into the called frame.
class Name(str):
def __eq__(self, other):
del x[self]
return str.__eq__(self, other)
def __hash__(self):
return str.__hash__(self)
x = {Name("a"):1, Name("b"):2}
def f(a, b): print a,b
f(**x) # Segfault
----------
messages: 62086
nosy: amaury.forgeotdarc
severity: normal
status: open
title: Crash when modifying the **kwargs passed to a function.
type: crash
versions: Python 2.5, Python 2.6
__________________________________
Tracker <[EMAIL PROTECTED]>
<http://bugs.python.org/issue2016>
__________________________________
_______________________________________________
Python-bugs-list mailing list
Unsubscribe:
http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
