Make CPython segfault in 5 lines of code

sigjuice wrote: post #3

A quick search in bugs.python.org shows several crashes. I don’t know much about Python. Is there anything particularly special about this one?

Not necessarily, but I just found it interesting that it wasn't really anything all that crazy - it could in theory be possible to encounter this in a big enough code base that makes heavy use of coroutines and custom exception types.

Re: Make CPython segfault in 5 lines of code

#5

Post by mentat » Thu, Dec 19, 2019, 3:14 AM UTC

sigjuice wrote: post #3

A quick search in bugs.python.org shows several crashes. I don’t know much about Python. Is there anything particularly special about this one?

I read it as related to the "limit Python to 1 million lines so it can be stable."

Re: Make CPython segfault in 5 lines of code

#6

Post by lucy_gatenby » Thu, Dec 19, 2019, 3:19 AM UTC

sigjuice wrote: post #3

A quick search in bugs.python.org shows several crashes. I don’t know much about Python. Is there anything particularly special about this one?

Just for fun, here's another one:

  import sys, threading
  def r():
      sys.stdin.buffer.read(1)
  t = threading.Thread(target=r, daemon=True)
  t.start()

Re: Make CPython segfault in 5 lines of code

#7

Post by lpghatguy » Thu, Dec 19, 2019, 3:31 AM UTC

Segfaults in scripting languages are remarkably common, especially if arbitrary bytecode can be loaded into the VM.

One I ran into in the wild recently is that in older versions of Lua, exceptions in GC finalizers (the `__gc` metamethod) can trigger a segfault. In those same versions of Lua, the bytecode format is notoriously dangerous to load.

I wonder whether this will be a large component of newer scripting language implementations. Do these safety issues warrant use of memory safe languages like Rust, or use of existing sandboxed VM implementations like WebAssembly?

Re: Make CPython segfault in 5 lines of code

#8

Post by saagarjha » Thu, Dec 19, 2019, 3:41 AM UTC

lucy_gatenby wrote: post #6

sigjuice wrote: post #3

A quick search in bugs.python.org shows several crashes. I don’t know much about Python. Is there anything particularly special about this one?

Just for fun, here's another one: import sys, threading def r(): sys.stdin.buffer.read(1) t = threading.Thread(target=r, daemon=True) t.start()

At least that one is an abort…

Re: Make CPython segfault in 5 lines of code

#9

Post by danielheath » Thu, Dec 19, 2019, 3:59 AM UTC

lpghatguy wrote: post #7

Segfaults in scripting languages are remarkably common, especially if arbitrary bytecode can be loaded into the VM. One I ran into in the wild recently is that in older versions of Lua, exceptions in GC finalizers (the `__gc` metamethod) can trigger a segfault. In those same versions of Lua, the bytecode format is notoriously dangerous to load. I wonder whether this will be a large component of newer scripting langua…

IMO the biggest reason to adopt the WebAssembly format is that a segfault inside the runtime doesn't affect the host process at all.

It's a plausible approach to a fully-safe, near-native-speed plugin architecture.

Re: Make CPython segfault in 5 lines of code

#10

Post by Thorrez » Thu, Dec 19, 2019, 4:10 AM UTC

lucy_gatenby wrote: post #6

sigjuice wrote: post #3

A quick search in bugs.python.org shows several crashes. I don’t know much about Python. Is there anything particularly special about this one?

Just for fun, here's another one: import sys, threading def r(): sys.stdin.buffer.read(1) t = threading.Thread(target=r, daemon=True) t.start()

Here's a Python 2 segfault I ran into recently.

    import sys, threading, time
    
    t = threading.Thread(target=sys.stdin.read, args=(1,))
    t.start()
    time.sleep(1)
    sys.stdin.close()

Run it then after a few seconds press enter. It doesn't segfault in Python 3, but it still doesn't behave how I'd like, because I would like the close() to unblock the read(), but it doesn't unblock the read(), the read() still hangs until it gets some input.