1 """ 2 There is a way to put keys of any type in a type's dictionary. 3 I think this allows various kinds of crashes, but so far I have only 4 found a convoluted attack of _PyType_Lookup(), which uses the mro of the 5 type without holding a strong reference to it. Probably works with 6 super.__getattribute__() too, which uses the same kind of code. 7 """ 8 9 class MyKey(object): 10 def __hash__(self): 11 return hash('mykey') 12 13 def __cmp__(self, other): 14 # the following line decrefs the previous X.__mro__ 15 X.__bases__ = (Base2,) 16 # trash all tuples of length 3, to make sure that the items of 17 # the previous X.__mro__ are really garbage 18 z = [] 19 for i in range(1000): 20 z.append((i, None, None)) 21 return -1 22 23 24 class Base(object): 25 mykey = 'from Base' 26 27 class Base2(object): 28 mykey = 'from Base2' 29 30 # you can't add a non-string key to X.__dict__, but it can be 31 # there from the beginning :-) 32 X = type('X', (Base,), {MyKey(): 5}) 33 34 print X.mykey 35 # I get a segfault, or a slightly wrong assertion error in a debug build. 36
