[New-bugs-announce] [issue2016] Crash when modifying the **kwargs passed to a function.

[Amaury Forgeot d'Arc]

New submission from Amaury Forgeot d'Arc:

The following script exploits a comment in funcobject.c:
   /* XXX This is broken if the caller deletes dict items! */
Because the code only borrows references to the items, it is possible to
have them destroyed before they are copied into the called frame.

class Name(str):
  def __eq__(self, other):
     del x[self]
     return str.__eq__(self, other)
  def __hash__(self):
     return str.__hash__(self)

x = {Name("a"):1, Name("b"):2}
def f(a, b): print a,b

f(**x)   # Segfault

----------
messages: 62086
nosy: amaury.forgeotdarc
severity: normal
status: open
title: Crash when modifying the **kwargs passed to a function.
type: crash
versions: Python 2.5, Python 2.6

__________________________________
Tracker <report at bugs.python.org>
<http://bugs.python.org/issue2016>
__________________________________