Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Get rid of PyToken #94

Closed
ExpHP opened this issue Dec 13, 2017 · 1 comment
Closed

Get rid of PyToken #94

ExpHP opened this issue Dec 13, 2017 · 1 comment
Labels
Milestone

Comments

@ExpHP
Copy link

ExpHP commented Dec 13, 2017

I'm not sure what PyToken is supposed to serve as a proof of, exactly, but in any case, it is possible to own one without a hold on the GIL. The following code segfaults on my machine.

Cargo.toml

[package]
authors = ["Michael Lamparski <[email protected]>"]
name = "token"
version = "0.1.0"

[dependencies]
pyo3 = { version = "0.2.3" }

src/main.rs

#![feature(proc_macro, specialization)]

extern crate pyo3;

use pyo3::prelude::*;

#[py::class]
struct Dummy { }

fn main() {

    // Temporarily acquire the GIL and save the token
    let mut evil = None;
    Python::acquire_gil().python().init(|token| {
        evil = Some(token);
        Dummy { }
    }).unwrap();
    let token = evil.unwrap();

    // Use python without acquiring the GIL
    token.py().import("sys").unwrap();
}
@fafhrd91
Copy link
Contributor

yes, I know about this. token is too weak protection, you can easily abuse it.

I was planing to remove it, I don't have much time at the moment.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

3 participants