4 ms·
Yup. There are literally millions of instances of code that slurps and Just Works and the users don't care and the investors don't care and the servers don't ca
by rsobers 13y ago
Yup. There are literally millions of instances of code that slurps and Just Works and the users don't care and the investors don't care and the servers don't care and the programmer just moved on with life and knocked out the next feature. And nobody cared and it never mattered that it was "wrong."
- pyre 13y agoIt could be used as a known vector to crash the program. Turn the file that it reads into something that will fill up RAM unless Python has some size checks before slurping.
- mistercow 13y agoAn attacker with that access can also DoS a program that doesn't slurp using the same technique. Also, on a 64-bit system, a DoS is all you can realistically get from this vector anyway. I don't know what happens if you actually fill Python's available address space (it seems pretty difficult), but I'd be shocked if it were a crash, and not an exception.