homepage

Similar to the bug in tuple() shown in the current
(r47245) version of Lib/test/crashers/gc_inspection.py,
filter() can be exploited in similar ways.
Rather than the tricky generator used to exploit
tuple(), the attached test case uses a subclass of
tuple with a malicious __getitem__ method. The pattern
being exploited is the same, however: a built-in
function pre-allocates a tuple, then fills it using
calls to user-defined code.
gc_inspection.py.diff also expands the infrastructure
in gc_inspection.py, allowing multiple test functions
to run that could crash the interpreter.
The second patch, fix_filter_crash.patch, is against
Python/bltinmodule.c and adds
_PyObject_GC_TRACK/UNTRACK macros around the call to
the type's sq_item slot in filtertuple().

Logged In: YES 
user_id=1344176
An alternative fix for this would be not to invoke
filter{tuple,string,unicode} on instances of subclasses of
tuple, str and unicode.
This would fix this bug because you have to be using a
subclass of one of these types to exploit the preallocation.
As a side-effect, this would also resolve the issue I raised
in bug #1517509 concerning filter()'s treatment of these
subtypes re: the iterator protocol.

Logged In: YES 
user_id=80475
FWIW, I think these safe-cracking style efforts at 
creating crashers is a waste of time. Please focus your 
efforts on fixing real bugs that matter, not in creating 
strange self-referential twists designed to poke holes in 
specific implementation details. There is no end to the 
kind of things like this that can be found and "fixing" 
them involves either making the code more convoluted or 
making the code slower but it won't make life better for 
most users. Also, I'm concerned that these "fixes" would 
need to be reviewed with extreme care, lest we introduce 
some new, real bug that DOES impact people's lives. If 
there were a real problem with filter(), we would have 
known it long ago.

Logged In: YES 
user_id=849994
I will not disagree with Raymond :)
Furthermore, with your patch to gc_inspection.py, it doesn't
even crash anymore (without the other patch applied).