Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Make CPython segfault in 5 lines of code

gist.github.com

Post reply on HN
Print view View original

41–50 of 78 posts

Re: Make CPython segfault in 5 lines of code

#41

Post by chubot »

tome wrote: post #39
chubot wrote: post #38

Earlier quoted context omitted.

None of those are trapped errors. In Python, Java, C, OCaml, and most other languages, 1 / 0 aborts the program. That is, division by zero is a trapped error. In JavaScript, it's not. It keeps going and lets you do stuff like access nonexistent properties .foo on the result, which are also untrapped errors . So JavaScript is unsafe in Cardelli's terminology. It gives you untrapped errors rather than trapped ones. The…

It's Infinity in Haskell Prelude> 1.0 / 0.0 :: Double Infinity

Thanks, removed.

I’m sort of surprised by that since my memory is that infinity isn’t a real number, rational, etc. That is, does infinity in Haskell obey some algebraic laws?

Re: Make CPython segfault in 5 lines of code

#42

Post by WoodTree »

chubot wrote: post #41
tome wrote: post #39

Earlier quoted context omitted.

It's Infinity in Haskell Prelude> 1.0 / 0.0 :: Double Infinity

Thanks, removed. I’m sort of surprised by that since my memory is that infinity isn’t a real number, rational, etc. That is, does infinity in Haskell obey some algebraic laws?

Infinity is a valid floating point number in the ISO standard.

However integer division by 0 isn’t. div 1 0 will fail.

Re: Make CPython segfault in 5 lines of code

#44

Post by loeg »

Thorrez wrote: post #10
lucy_gatenby wrote: post #6

Earlier quoted context omitted.

Just for fun, here's another one: import sys, threading def r(): sys.stdin.buffer.read(1) t = threading.Thread(target=r, daemon=True) t.start()

Here's a Python 2 segfault I ran into recently. import sys, threading, time t = threading.Thread(target=sys.stdin.read, args=(1,)) t.start() time.sleep(1) sys.stdin.close() Run it then after a few seconds press enter. It doesn't segfault in Python 3, but it still doesn't behave how I'd like, because I would like the close() to unblock the read(), but it doesn't unblock the read(), the read() still hangs until it gets…

The whole threading library in Python is a mess. Python was designed around single threaded programs with shared-nothing state and the cracks show as you move beyond that. The whole idea of replacing the GIL with... multiple same-process distinct-state Python interpreters with cheap-ish message passing sort of highlights how ugly it gets.

Re: Make CPython segfault in 5 lines of code

#45

Post by WoodTree »

chubot wrote: post #38
banana_smoothie wrote: post #23

Earlier quoted context omitted.

> such as (1/0).foo.foo (and yes you need the second .foo…) I don't understand the nuance here. In my Firefox developer tools, I can do the following: > (1/0).foo.foo ---> TypeError: (intermediate value).foo is undefined > (1/0).foo ---> undefined > (1/1).foo.foo ---> TypeError: 1.foo is undefined > Infinity.foo.foo ---> TypeError: Infinity.foo is undefined > undefined.foo ---> TypeError: undefined has no properties…

None of those are trapped errors. In Python, Java, C, OCaml, and most other languages, 1 / 0 aborts the program. That is, division by zero is a trapped error. In JavaScript, it's not. It keeps going and lets you do stuff like access nonexistent properties .foo on the result, which are also untrapped errors . So JavaScript is unsafe in Cardelli's terminology. It gives you untrapped errors rather than trapped ones. The…

This is false. Integer division by zero is undefined, but floating point division is perfectly fine. Many languages have different operators to distinguish floating point and integer division, like pythons / for floats and // for integers.

Re: Make CPython segfault in 5 lines of code

#46

Post by shakna »

tus88 wrote: post #17
lpghatguy wrote: post #7

Segfaults in scripting languages are remarkably common, especially if arbitrary bytecode can be loaded into the VM. One I ran into in the wild recently is that in older versions of Lua, exceptions in GC finalizers (the `__gc` metamethod) can trigger a segfault. In those same versions of Lua, the bytecode format is notoriously dangerous to load. I wonder whether this will be a large component of newer scripting langua…

> Segfaults in scripting languages are remarkably common What about Javascript running on V8?

Yes, even there. [0]

[0] https://github.com/nodejs/node/pulls?utf8=%E2%9C%93&q=is%3Ap...

Re: Make CPython segfault in 5 lines of code

#47

Post by shakna »

dependenttypes wrote: post #16

This would not have happened in a language with a proper type system as the type checker would have rejected the program at compile time.

> This would not have happened in a language with a proper type system as the type checker would have rejected the program at compile time.

How about in Rust, then? [0]

Bugs happen in every language. When memory corruption occurs, you can segfault.

[0] https://users.rust-lang.org/t/rust-guarantees-no-segfaults-w...

Re: Make CPython segfault in 5 lines of code

#48

Post by orf »

schoen wrote: post #18
lpghatguy wrote: post #7

Segfaults in scripting languages are remarkably common, especially if arbitrary bytecode can be loaded into the VM. One I ran into in the wild recently is that in older versions of Lua, exceptions in GC finalizers (the `__gc` metamethod) can trigger a segfault. In those same versions of Lua, the bytecode format is notoriously dangerous to load. I wonder whether this will be a large component of newer scripting langua…

Is anybody fuzzing Python bytecodes? This sounds like a super-great application for afl.

I did this a while back: https://tomforb.es/segfaulting-python-with-afl-fuzz/

CPython bytecode will segfault Python if it’s slightly incorrect. And that’s fine, it’s not a security risk and it’s not worth the performance overhead of validating wonky bytecode.

Re: Make CPython segfault in 5 lines of code

#49

Post by quietbritishjim »

poizan42 wrote: post #30
schoen wrote: post #18

Earlier quoted context omitted.

Is anybody fuzzing Python bytecodes? This sounds like a super-great application for afl.

It has always been the position of the CPython developers that using python for sandboxing is unsupported. With that in mind it doesn't really matter if you can "exploit" python with weird bytecode because you are supposed to be on the other side of the airtight hatchway[0] anyways. I don't know what the stance of other python runtimes are, but you should probably just use a sandbox at OS level which is likely to be…

Comments for that link:

https://web.archive.org/web/20190113115213/https://blogs.msd...

Re: Make CPython segfault in 5 lines of code

#50

Post by dependenttypes »

shakna wrote: post #47
dependenttypes wrote: post #16

This would not have happened in a language with a proper type system as the type checker would have rejected the program at compile time.

> This would not have happened in a language with a proper type system as the type checker would have rejected the program at compile time. How about in Rust, then? [0] Bugs happen in every language. When memory corruption occurs, you can segfault. [0] https://users.rust-lang.org/t/rust-guarantees-no-segfaults-w...

I said "a language with a proper type system". Rust is not one such language.
Post reply on HN