Hacker News Reader

Comment by Retr0id | Hacker News Reader

You don't even need a ctypes import for it, you'll get a segfault from this:

   eval((lambda:0).__code__.replace(co_consts=()))

cpython is not memory safe.

View on HN

Static analysis of Python code should include review of "unsafe" things like exec(), eval(), ctypes, c strings, memcpy (*),.

Containers are considered nearly sufficient to sandbox Python, which cannot be effectively sandboxed using Python itself. Isn't that actually true for all languages though?

There's a RustPython, but it does support CFFI and __builtins__.eval, so

The example given by parent does not need eval to trigger though. Just create a function and replace its code object then call it, it will easily segfault.

Complete example without eval:

  def f(): pass
  f.__code__ = f.__code__.replace(co_consts=())
  f()

yup, eval was just there for golfing purposes

Reply on news.ycombinator.com