diff options
| -rw-r--r-- | Lib/test/crashers/borrowed_ref_3.py | 14 |
1 files changed, 14 insertions, 0 deletions
diff --git a/Lib/test/crashers/borrowed_ref_3.py b/Lib/test/crashers/borrowed_ref_3.py new file mode 100644 index 0000000000..f241108635 --- /dev/null +++ b/Lib/test/crashers/borrowed_ref_3.py @@ -0,0 +1,14 @@ +""" +PyDict_GetItem() returns a borrowed reference. +There are probably a number of places that are open to attacks +such as the following one, in bltinmodule.c:min_max(). +""" + +class KeyFunc(object): + def __call__(self, n): + del d['key'] + return 1 + + +d = {'key': KeyFunc()} +min(range(10), **d) |