3 ms·

You don't even need a ctypes import for it, you'll get a segfault from this: eval((lambda:0).__code__.replace(co_consts=())) cpython is not memory safe.

• westurner 3y ago
  Static analysis of Python code should include review of "unsafe" things like exec(), eval(), ctypes, c strings, memcpy (*),. Containers are considered nearly sufficient to sandbox Python, which cannot be effectively sandboxed using Python itself. Isn't that actually true for all languages though? There's a RustPython, but it does support CFFI and __builtins__.eval, so
  • maple3142 3y ago
    The example given by parent does not need eval to trigger though. Just create a function and replace its code object then call it, it will easily segfault.
    • jwilk 3y ago
      Complete example without eval: def f(): pass f.__code__ = f.__code__.replace(co_consts=()) f()
      • Retr0id 3y ago
        yup, eval was just there for golfing purposes