[Python-Dev] IEEE/ISO draft on Python vulnerabilities

2011-12-17 Thread Kevin Coyne
Victor: Python.3 Type System [IHN] - The use of “extended precision” as a term to express Python’s ability to create and manipulate integers of any size (within the memory limitations of the computer) is poor since that term is used in reference to floating point numbers almost exclusively. I

Re: [Python-Dev] IEEE/ISO draft on Python vulnerabilities

2011-12-13 Thread Amaury Forgeot d'Arc
2011/12/12 Victor Stinner victor.stin...@haypocalc.com When sorting a list using the sort() method, attempting to inspect or mutate the content of the list will result in undefined behaviour. But is this even true? in listobject.c::listsort(), since 2002, /* The list is temporarily made

Re: [Python-Dev] IEEE/ISO draft on Python vulnerabilities

2011-12-13 Thread Armin Rigo
Hi, On Tue, Dec 13, 2011 at 11:37, Amaury Forgeot d'Arc amaur...@gmail.com wrote: When sorting a list using the sort() method, attempting to inspect or mutate the content of the list will result in undefined behaviour. (...) So behaviour is not undefined at all... No, the behavior _is_

Re: [Python-Dev] IEEE/ISO draft on Python vulnerabilities

2011-12-13 Thread Amaury Forgeot d'Arc
2011/12/13 Armin Rigo ar...@tunes.org No, the behavior _is_ undefined. The comment you cited says that it cannot crash the Python interpreter; additionally, it makes a best-effort attempt at catching such accesses and raising ValueError. But I think I can build a strange-looking example

[Python-Dev] IEEE/ISO draft on Python vulnerabilities

2011-12-12 Thread Eric Snow
re-sending with subject :) On Mon, Dec 12, 2011 at 2:44 PM, Eric Snow ericsnowcurren...@gmail.com wrote: Guido posted this on Google+: IEEE/ISO are working on a draft document about Python vulunerabilities:

Re: [Python-Dev] IEEE/ISO draft on Python vulnerabilities

2011-12-12 Thread Victor Stinner
IEEE/ISO are working on a draft document about Python vulunerabilities: http://grouper.ieee.org/groups/plv/DocLog/300-399/360-thru-379/22-WG23-N-0372/n0372.pdf (in the context of a larger effort to classify vulnerabilities in all languages: ISO/IEC TR 24772:2010, available from ISO at no cost