Hash collision security issue

Modules/main.c

 /* Python interpreter main program */
 
 #include "Python.h"
 #include "osdefs.h"
 #include "import.h"
 
 #include <locale.h>
 
 #ifdef __VMS
 #include <unixlib.h>
@@ skipping 29 matching lines @@
 
 #ifdef __cplusplus
 extern "C" {
 #endif
 
 /* For Py_GetArgcArgv(); set by main() */
 static wchar_t **orig_argv;
 static int  orig_argc;
 
 /* command line options */
-#define BASE_OPTS L"bBc:dEhiJm:OsStuvVW:xX?"
+#define BASE_OPTS L"bBc:dEhiJm:ORsStuvVW:xX?"
 
 #define PROGRAM_OPTS BASE_OPTS
 
 /* Short usage message (with %s for argv0) */
 static char *usage_line =
 "usage: %ls [option] ... [-c cmd | -m mod | file | -] [arg] ...\n";
 
 /* Long usage message, split into parts < 512 bytes */
 static char *usage_1 = "\
 Options and arguments (and corresponding environment variables):\n\
 -b     : issue warnings about str(bytes_instance), str(bytearray_instance)\n\
          and comparing bytes/bytearray with str. (-bb: issue errors)\n\
 -B     : don't write .py[co] files on import; also PYTHONDONTWRITEBYTECODE=x\n\
 -c cmd : program passed in as string (terminates option list)\n\
 -d     : debug output from parser; also PYTHONDEBUG=x\n\
 -E     : ignore PYTHON* environment variables (such as PYTHONPATH)\n\
 -h     : print this help message and exit (also --help)\n\
 ";
 static char *usage_2 = "\
 -i     : inspect interactively after running script; forces a prompt even\n\
          if stdin does not appear to be a terminal; also PYTHONINSPECT=x\n\
 -m mod : run library module as a script (terminates option list)\n\
 -O     : optimize generated bytecode slightly; also PYTHONOPTIMIZE=x\n\
 -OO    : remove doc-strings in addition to the -O optimizations\n\
+-R     : use a pseudo-random salt to make hash() values of various types be\n\
+         unpredictable between separate invocations of the interpreter, as\n\
+         a defence against denial-of-service attacks\n\
 -s     : don't add user site directory to sys.path; also PYTHONNOUSERSITE\n\
 -S     : don't imply 'import site' on initialization\n\
 ";
 static char *usage_3 = "\
 -u     : unbuffered binary stdout and stderr; also PYTHONUNBUFFERED=x\n\
          see man page for details on internal buffering relating to '-u'\n\
 -v     : verbose (trace import statements); also PYTHONVERBOSE=x\n\
          can be supplied multiple times to increase verbosity\n\
 -V     : print the Python version number and exit (also --version)\n\
 -W arg : warning control; arg is action:message:category:module:lineno\n\
 -x     : skip first line of source, allowing use of non-Unix forms of #!cmd\n\
 ";
 static char *usage_4 = "\
 file   : program read from script file\n\
 -      : program read from stdin (default; interactive mode if a tty)\n\
 arg ...: arguments passed to program in sys.argv[1:]\n\n\
 Other environment variables:\n\
 PYTHONSTARTUP: file executed on interactive startup (no default)\n\
 PYTHONPATH   : '%c'-separated list of directories prefixed to the\n\
                default module search path.  The result is sys.path.\n\
 ";
 static char *usage_5 = "\
 PYTHONHOME   : alternate <prefix> directory (or <prefix>%c<exec_prefix>).\n\
                The default module search path uses %s.\n\
 PYTHONCASEOK : ignore case in 'import' statements (Windows).\n\
 PYTHONIOENCODING: Encoding[:errors] used for stdin/stdout/stderr.\n\
 ";
+static char *usage_6 = "\
+PYTHONHASHSEED: if this variable is set to ``random``, the effect is the same \n\
+   as specifying the :option:`-R` option: a random value is used to seed the\n\
+   hashes of str, bytes and datetime objects.  It can also be set to an integer\n\
+   in the range [0,4294967295] to get hash values with a predictable seed.\n\
+";
 
 #ifndef MS_WINDOWS
 static FILE*
 _wfopen(const wchar_t *path, const wchar_t *mode)
 {
     char cpath[PATH_MAX];
     char cmode[10];
     size_t r;
     r = wcstombs(cpath, path, PATH_MAX);
     if (r == (size_t)-1 || r >= PATH_MAX) {
@@ skipping 17 matching lines @@
 
     fprintf(f, usage_line, program);
     if (exitcode)
         fprintf(f, "Try `python -h' for more information.\n");
     else {
         fputs(usage_1, f);
         fputs(usage_2, f);
         fputs(usage_3, f);
         fprintf(f, usage_4, DELIM);
         fprintf(f, usage_5, DELIM, PYTHONHOMEHELP);
+        fputs(usage_6, f);
     }
 #if defined(__VMS)
     if (exitcode == 0) {
         /* suppress 'error' message */
         return 1;
     }
     else {
         /* STS$M_INHIB_MSG + SS$_ABORT */
         return 0x1000002c;
     }
@@ skipping 215 matching lines @@
         case '?':
             help++;
             break;
 
         case 'V':
             version++;
             break;
 
         case 'W':
             PySys_AddWarnOption(_PyOS_optarg);
+            break;
+
+        case 'R':
+            Py_HashRandomizationFlag++;
             break;
 
         /* This space reserved for other options */
 
         default:
             return usage(2, argv[0]);
             /*NOTREACHED*/
 
         }
     }
@@ skipping 274 matching lines @@
 void
 Py_GetArgcArgv(int *argc, wchar_t ***argv)
 {
     *argc = orig_argc;
     *argv = orig_argv;
 }
 
 #ifdef __cplusplus
 }
 #endif