This issue tracker has been migrated to GitHub, and is currently read-only.
For more information, see the GitHub FAQs in the Python's Developer Guide.

classification
Title: Infinite crash leading to DoS
Type: security Stage:
Components: Versions:
process
Status: closed Resolution: not a bug
Dependencies: Superseder:
Assigned To: Nosy List: brett.cannon, pabstersac, vstinner
Priority: normal Keywords:

Created on 2016-03-08 02:25 by pabstersac, last changed 2022-04-11 14:58 by admin. This issue is now closed.

Files
File name Uploaded Description Edit
crash.py pabstersac, 2016-03-08 02:25 Crashes Python Infinitely
Messages (6)
msg261319 - (view) Author: pablo sacristan (pabstersac) Date: 2016-03-08 02:25
import ctypes, struct, sys, os
while 1:
    os.system('python /Users/pabstersac/Desktop/Python\ Files/crash.py') #Change to your full path to the file
    inner = ()
    outer = (inner,)
    c_outer = (ctypes.c_char * sys.getsizeof(outer)).from_address(id(outer))
    inner_index = c_outer[:].find(struct.pack('P', id(inner)))
    c_outer[inner_index:inner_index+struct.calcsize('P')] = struct.pack('P', id(outer))
    print outer
    #construct and print a self-referencing tuple
run it and wait around 10 sec for it to happen, but once it starts you will be forced to force it to shut because it will keep on crashing infinitely which is extremely annoying, and even while it says it crashed it still runs and keeps on running infinitely, which if you do on an unexpecting victim, they will probably shut down the computer directly.
There are basically two problems here, the way you construct and then print a self-referencing tuple, and the way you handle when it is put in an infinite loop with itself calling its own file (which if you wait long enough will see the effect goes quicker every second, it goes up exponentially) and you don't stop it correctly.
msg261341 - (view) Author: STINNER Victor (vstinner) * (Python committer) Date: 2016-03-08 10:54
> "construct and print a self-referencing tuple"

I don't understand the use case here. In pure Python, you cannot build a self-referecing tuple!?

Yeah, using the C API or by modifying bytes directly in the memory, you can do that. But if you start to use the C API, you must be careful. The C API is designed for speed, not to prevent bugs.

I don't think that we should fix anything in Python. I don't consider that it's a bug in Python.


> run it and wait around 10 sec for it to happen, but once it starts you will be forced to force it to shut because it will keep on crashing infinitely which is extremely annoying,

Basically, crash.py is a fork-bomb: the program starts itself in a loop. It's not a bug in Python.
msg261395 - (view) Author: pablo sacristan (pabstersac) Date: 2016-03-09 02:30
Then it is no bug that it crashes python? You don't have to put it in a loop, but by looping it I am adding the part that makes it take more time but will keep on crashing infinitely, take away the while loop but not what it has inside and then also delete the os.system() and you get python to crash once. Is a crash not a bug?
msg261396 - (view) Author: pablo sacristan (pabstersac) Date: 2016-03-09 02:32
New content for crash.py:

import ctypes, struct, sys, os
inner = ()
    outer = (inner,)
    c_outer = (ctypes.c_char * sys.getsizeof(outer)).from_address(id(outer))
    inner_index = c_outer[:].find(struct.pack('P', id(inner)))
    c_outer[inner_index:inner_index+struct.calcsize('P')] = struct.pack('P', id(outer))
    print outer
msg261397 - (view) Author: Brett Cannon (brett.cannon) * (Python committer) Date: 2016-03-09 02:41
Victor's point is that this isn't a bug because you are manipulating the C API to make this occur. That means there is no safety guarantee and thus this is not a bug but simply a mis-use of the C API.
msg261408 - (view) Author: STINNER Victor (vstinner) * (Python committer) Date: 2016-03-09 09:03
"Then it is no bug that it crashes python?"

The bug is your program creating inconsistent data. Without ctypes, you cannot create such inconsistent data.

"Is a crash not a bug?"

There are various ways to "crash" Python, but most of them are deliberate bugs. For example:

haypo@selma$ python3
Python 3.4.3 (default, Jun 29 2015, 12:16:01) 
[GCC 5.1.1 20150618 (Red Hat 5.1.1-4)] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import ctypes
>>> ctypes.string_at(0)
Erreur de segmentation (core dumped)

The ctypes doesn't prevent you from making mistakes. If you use ctypes, you must be very careful and understand what you are doing.
History
Date User Action Args
2022-04-11 14:58:28adminsetgithub: 70695
2016-03-09 09:03:19vstinnersetmessages: + msg261408
2016-03-09 02:41:55brett.cannonsetstatus: open -> closed

nosy: + brett.cannon
messages: + msg261397

resolution: works for me -> not a bug
2016-03-09 02:33:25pabstersacsetstatus: closed -> open
2016-03-09 02:32:08pabstersacsetmessages: + msg261396
2016-03-09 02:30:32pabstersacsetresolution: not a bug -> works for me
messages: + msg261395
2016-03-08 10:54:22vstinnersetstatus: open -> closed

nosy: + vstinner
messages: + msg261341

resolution: not a bug
2016-03-08 02:25:22pabstersaccreate