Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Make CPython segfault in 5 lines of code

gist.github.com

Post reply on HN
Print view View original

71–78 of 78 posts

Re: Make CPython segfault in 5 lines of code

#71

Post by WoodTree »

chubot wrote: post #66
WoodTree wrote: post #42

Earlier quoted context omitted.

Infinity is a valid floating point number in the ISO standard. However integer division by 0 isn’t. div 1 0 will fail.

Yeah it's an interesting case. It appears that Inf is in floating point to AVOID a trapped error. This answer has an interesting way of looking at it. If you go on the theory that floating points are supposed to represent reals, then in floating point, you can't tell if a value is actually zero or just indistinguishably close to zero. In the case of "indistinguishably close to zero", you're getting the wrong answer,…

Floats aren’t reals, at best they are an approximation for certain calculations. +0 and -0 are defined and distinct floating point numbers. Floating point math is known to be problematic and does not evenly distribute numbers on the real line either. There are numerical methods used for reducing error on floating point operations when it is acceptable. Otherwise fixed point or intervals may be used.

Re: Make CPython segfault in 5 lines of code

#72

Post by loeg »

h2odragon wrote: post #61
loeg wrote: post #44

Earlier quoted context omitted.

The whole threading library in Python is a mess. Python was designed around single threaded programs with shared-nothing state and the cracks show as you move beyond that. The whole idea of replacing the GIL with... multiple same-process distinct-state Python interpreters with cheap-ish message passing sort of highlights how ugly it gets.

Back around python 1.5, there was almost a fork of python where every object had locks, there were memory arenas, and multiprocessing was almost thoughtlessly easy. That and stackless would've been great.

More recently than that, too, unless I'm misremembering. As sibling commenter points out, such a model is horrifically slow. Lock-for-every-object is too granular to perform well.

Re: Make CPython segfault in 5 lines of code

#73

Post by stevekemp »

lpghatguy wrote: post #7

Segfaults in scripting languages are remarkably common, especially if arbitrary bytecode can be loaded into the VM. One I ran into in the wild recently is that in older versions of Lua, exceptions in GC finalizers (the `__gc` metamethod) can trigger a segfault. In those same versions of Lua, the bytecode format is notoriously dangerous to load. I wonder whether this will be a large component of newer scripting langua…

Can confirm. I did some fuzz-testing of random scripting languages a while back, and reported bugs in things like GNU Awk.

Here's a trivial example:

    /usr/bin/gawk 'for (i = ) in steve kemp rocks'
I found fuzz-testing like this very very useful when writing my own BASIC interpreter, and playing with scripting languages though. It's almost magical how quickly problems are found!

Re: Make CPython segfault in 5 lines of code

#74

Post by rini17 »

Dylan16807 wrote: post #70
rini17 wrote: post #68

Earlier quoted context omitted.

WebAssembly follows the unfortunate C paradigm that no checks are done at runtime, only these that programmer requests explicitly (and only if no undefined behavior is involved), to improve speed. The WASM sandbox can call only set of specified host functions, but I expect so much functionality snowballing inside sandboxes that we'll have to allow everything including unsafe ones, anyway.

WebAssembly uses 32 bit indexes to access memory. The default way of implementing memory safety for it is to put a few gigabytes of dead address space before and after the memory a WASM program uses. This makes it impossible for the memory access instructions to escape, despite having no runtime checks. So it can segfault all the way up to the machine level. But more importantly, it's safe for it to 'segfault' out of…

This is nothing new, memory space of a process in all modern OSes is protected so that segfaults are safe too. Combined with original UNIX idea of small tools that communicate by pipes it was fine.

But now the processes are behemoths with gigabytes of dynamically linked libraries that are too hard to secure and to restrict system access, we just enable everything. This will happen to wasm. I'm sure there are WASM blobs configured with unfettered access to DOM in the wild already.

Re: Make CPython segfault in 5 lines of code

#75

Post by dependenttypes »

shakna wrote: post #58
dependenttypes wrote: post #50

Earlier quoted context omitted.

I said "a language with a proper type system". Rust is not one such language.

You'll need to define "proper type system" then. At a guess, you want something with dependent types? Like Idris, or Haskell. You already have a Haskell example. This [0] release of Idris fixed a segfault when concatenating strings. Maybe you meant a language that is proven from the ground up. Like CakeML. You can find a segfault example here [1]. Maybe you meant a language with an algebraic type system like Ada. You…

You can trivially prove bottom in Haskell. Something like Agda or Idris would indeed fit the bill better.

Anyway, I said that this specific issue would not occur in a language with dependent types -- where incorrect code would cause the implementation to crash. Not that it is impossible to have a buggy compiler that at certain cases produces segfaults.

Re: Make CPython segfault in 5 lines of code

#76

Post by dependenttypes »

Znafon wrote: post #52
dependenttypes wrote: post #50

Earlier quoted context omitted.

I said "a language with a proper type system". Rust is not one such language.

Can you give an example of such language so we don't have to guess? Apparently neither Rust, Haskell nor Go fit.

check my username

Re: Make CPython segfault in 5 lines of code

#77

Post by shakna »

dependenttypes wrote: post #75
shakna wrote: post #58

Earlier quoted context omitted.

You'll need to define "proper type system" then. At a guess, you want something with dependent types? Like Idris, or Haskell. You already have a Haskell example. This [0] release of Idris fixed a segfault when concatenating strings. Maybe you meant a language that is proven from the ground up. Like CakeML. You can find a segfault example here [1]. Maybe you meant a language with an algebraic type system like Ada. You…

You can trivially prove bottom in Haskell. Something like Agda or Idris would indeed fit the bill better. Anyway, I said that this specific issue would not occur in a language with dependent types -- where incorrect code would cause the implementation to crash. Not that it is impossible to have a buggy compiler that at certain cases produces segfaults.

> Not that it is impossible to have a buggy compiler that at certain cases produces segfaults.

That's exactly what happened here, however. The instance check was missing from the interpreter.

Dependant types wouldn't have solved the underlying problem.

Re: Make CPython segfault in 5 lines of code

#78

Post by Dylan16807 »

rini17 wrote: post #74
Dylan16807 wrote: post #70

Earlier quoted context omitted.

WebAssembly uses 32 bit indexes to access memory. The default way of implementing memory safety for it is to put a few gigabytes of dead address space before and after the memory a WASM program uses. This makes it impossible for the memory access instructions to escape, despite having no runtime checks. So it can segfault all the way up to the machine level. But more importantly, it's safe for it to 'segfault' out of…

This is nothing new, memory space of a process in all modern OSes is protected so that segfaults are safe too. Combined with original UNIX idea of small tools that communicate by pipes it was fine. But now the processes are behemoths with gigabytes of dynamically linked libraries that are too hard to secure and to restrict system access, we just enable everything. This will happen to wasm. I'm sure there are WASM blo…

> This is nothing new, memory space of a process in all modern OSes is protected so that segfaults are safe too.

Right, but look at what I'm replying to.

"The way they said it, though, makes it sound like WebAssembly is implemented with full process sandboxing or something, which is patently false."

Unlike with Javascript, the program hosting a WASM script is immune to corrupt pointers inside the script. That's equivalent to OS-level isolation, which is pretty good!

> But now the processes are behemoths with gigabytes of dynamically linked libraries that are too hard to secure and to restrict system access, we just enable everything. This will happen to wasm. I'm sure there are WASM blobs configured with unfettered access to DOM in the wild already.

There will inevitably be bugs in the code handling the html/css/dom/rendering. But WASM greatly reduces the attack surface of the scripting VM.

The types of bugs most likely to still exist with WASM are the types where isolating it in a separate process that communicates by pipes wouldn't help.

Post reply on HN