Skip to content

Use-after-free in jsonyx.dump mapping iteration via re-entrant key encoder #54

@nineteendo

Description

@nineteendo

See python/cpython#142831

import jsonyx as json

entries = [("boom", object())]

class BadDict(dict):
    def items(self):
        return entries

def hook(obj):
    if isinstance(obj, str):
        entries.clear()

    return obj

json.dump(BadDict(), hook=hook)

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions