| """ | |
| There is a way to put keys of any type in a type's dictionary. | |
| I think this allows various kinds of crashes, but so far I have only | |
| found a convoluted attack of _PyType_Lookup(), which uses the mro of the | |
| type without holding a strong reference to it. Probably works with | |
| super.__getattribute__() too, which uses the same kind of code. | |
| """ | |
| class MyKey(object): | |
| def __hash__(self): | |
| return hash('mykey') | |
| def __cmp__(self, other): | |
| # the following line decrefs the previous X.__mro__ | |
| X.__bases__ = (Base2,) | |
| # trash all tuples of length 3, to make sure that the items of | |
| # the previous X.__mro__ are really garbage | |
| z = [] | |
| for i in range(1000): | |
| z.append((i, None, None)) | |
| return -1 | |
| class Base(object): | |
| mykey = 'from Base' | |
| class Base2(object): | |
| mykey = 'from Base2' | |
| # you can't add a non-string key to X.__dict__, but it can be | |
| # there from the beginning :-) | |
| X = type('X', (Base,), {MyKey(): 5}) | |
| print X.mykey | |
| # I get a segfault, or a slightly wrong assertion error in a debug build. |