| Server IP : 209.209.40.120 / Your IP : 216.73.217.112 Web Server : Microsoft-IIS/10.0 System : Windows NT NEWWWW 10.0 build 17763 (Windows Server 2019) i586 User : NEWWWW$ ( 0) PHP Version : 8.3.30 Disable Function : NONE MySQL : OFF | cURL : ON | WGET : OFF | Perl : OFF | Python : OFF | Sudo : OFF | Pkexec : OFF Directory : C:/Program Files/MySQL/MySQL Shell 1.0/lib/Python2.7/Lib/test/crashers/ |
Upload File : |
"""
General example for an attack against code like this:
Py_DECREF(obj->attr); obj->attr = ...;
here in Module/_json.c:scanner_init().
Explanation: if the first Py_DECREF() calls either a __del__ or a
weakref callback, it will run while the 'obj' appears to have in
'obj->attr' still the old reference to the object, but not holding
the reference count any more.
Status: progress has been made replacing these cases, but there is an
infinite number of such cases.
"""
import _json, weakref
class Ctx1(object):
encoding = "utf8"
strict = None
object_hook = None
object_pairs_hook = None
parse_float = None
parse_int = None
parse_constant = None
class Foo(unicode):
pass
def delete_me(*args):
print scanner.encoding.__dict__
class Ctx2(Ctx1):
@property
def encoding(self):
global wref
f = Foo("utf8")
f.abc = globals()
wref = weakref.ref(f, delete_me)
return f
scanner = _json.make_scanner(Ctx1())
scanner.__init__(Ctx2())