New submission from Antoine Pitrou pit...@free.fr:
Original e-mail from Apple security team:
Follow-up: 187806281
SSL 3.0 and TLS 1.0 are vulnerable to an attack described at
http://www.openssl.org/~bodo/tls-cbc.txt
OpenSSL includes a countermeasure which prevents the attack, but
Antoine Pitrou pit...@free.fr added the comment:
Attaching patches.
--
Added file: http://bugs.python.org/file24336/CVE-2011-3389-3.2.patch
___
Python tracker rep...@bugs.python.org
http://bugs.python.org/issue13885
Changes by Antoine Pitrou pit...@free.fr:
--
keywords: +patch
Added file: http://bugs.python.org/file24335/CVE-2011-3389-2.7.patch
___
Python tracker rep...@bugs.python.org
http://bugs.python.org/issue13885
___
Martin v. Löwis mar...@v.loewis.de added the comment:
Could the AVL tree approach be extended to apply to dictionaries
containing keys of any single type that supports comparison? That
approach would autodetect UserString or similar and support it
properly.
I think we would need a place to
Roundup Robot devn...@psf.upfronthosting.co.za added the comment:
New changeset 9a4131ada792 by Antoine Pitrou in branch '2.6':
Issue #13885: CVE-2011-3389: the _ssl module would always disable the CBC IV
attack countermeasure.
http://hg.python.org/cpython/rev/9a4131ada792
New changeset
Roundup Robot devn...@psf.upfronthosting.co.za added the comment:
New changeset e7706bdaaa0d by Antoine Pitrou in branch '3.1':
Issue #13885: CVE-2011-3389: the _ssl module would always disable the CBC IV
attack countermeasure.
http://hg.python.org/cpython/rev/e7706bdaaa0d
New changeset
Antoine Pitrou pit...@free.fr added the comment:
This hopefully fixes the issue.
--
resolution: - fixed
stage: commit review - committed/rejected
status: open - closed
___
Python tracker rep...@bugs.python.org
http://bugs.python.org/issue13885
Nadeem Vawda nadeem.va...@gmail.com added the comment:
I've also been unable to reproduce it on my own machine (AMD64; 8GB RAM).
I guess I'll have to do some trial-and-error debugging using the custom
builder to figure this out.
--
___
Python
Antoine Pitrou pit...@free.fr added the comment:
Indeed, there seems to be no mechanism available to forbid NUL chars under
Windows (for Python 3.x):
open(LICENSE\x00foobar)
_io.TextIOWrapper name='LICENSE\x00foobar' mode='r' encoding='cp1252'
os.stat(LICENSE\x00foobar)
Changes by Charles-François Natali neolo...@free.fr:
--
resolution: wont fix -
status: closed - open
___
Python tracker rep...@bugs.python.org
http://bugs.python.org/issue1003195
___
Charles-François Natali neolo...@free.fr added the comment:
See (permanently closed?) similar bug at:
I reopened it.
--
nosy: +neologix
resolution: - duplicate
stage: - committed/rejected
status: open - closed
superseder: - segfault when running smtplib example
Antoine Pitrou pit...@free.fr added the comment:
Since the NUL-scanning will be useful for Modules/posixmodule.c as well,
perhaps it should be done as a private _PyUnicode_HasNULChars() function.
--
___
Python tracker rep...@bugs.python.org
Roundup Robot devn...@psf.upfronthosting.co.za added the comment:
New changeset 2863d9273abd by Antoine Pitrou in branch '3.2':
Issue #13812: When a multiprocessing Process child raises an exception, flush
stderr after printing the exception traceback.
Antoine Pitrou pit...@free.fr added the comment:
Patch now committed, thanks.
--
resolution: - fixed
stage: patch review - committed/rejected
status: open - closed
___
Python tracker rep...@bugs.python.org
http://bugs.python.org/issue13812
New submission from Nadeem Vawda nadeem.va...@gmail.com:
I've recently come across a strange failure in the tests for the input()
built-in function:
$ ./python -E -m test -v test_readline test_builtin
[... snip ...]
Antoine Pitrou pit...@free.fr added the comment:
For the record, the proposed solution in that e-mail is the following:
B) Patch the run() method of pydoc module at line 1862:
for importer, modname, ispkg in
pkgutil.walk_packages(onerror=lambda s:None):
--
components:
Nadeem Vawda nadeem.va...@gmail.com added the comment:
Here's another patch that ensures the test always exercises the GNU
readline code path (rather than the stdio fallback). This will cause the
failure to occur when running just test_builtin (no need to also run
test_readline before it).
New submission from Jörn Hees nrej9...@joernhees.de:
I wanted to create a function registrar d using a defaultdict. The library
that this registrar is passed to expects it to return functions taking 3 args.
Now if the first call is d.get(x) it seems that in contrast to d[x] the default
arg of
New submission from Nadeem Vawda nadeem.va...@gmail.com:
While investigating issue 13886, I found that test_builtin will fail when run
after test_tk:
$ ./python -Wd -E -bb -m test -vuall test_tk test_builtin
== CPython 3.3.0a0 (default:52f68c95e025, Jan 26 2012, 19:05:09) [GCC 4.6.1]
Nick Coghlan ncogh...@gmail.com added the comment:
Just noting that the pep380 integration branch is also available in the
hg.python.org clone of my sandbox repo.
--
hgrepos: +107
___
Python tracker rep...@bugs.python.org
Nick Coghlan ncogh...@gmail.com added the comment:
Aside from some minor comments that I included in my review, the latest patch
gets a +1 from me.
--
___
Python tracker rep...@bugs.python.org
http://bugs.python.org/issue10181
Mark Dickinson dicki...@gmail.com added the comment:
It's certainly intentional behaviour: all the defaultdict does is provide a
__missing__ method. And as explained in
http://docs.python.org/library/stdtypes.html#mapping-types-dict
No other operations or methods invoke __missing__().
So
abhishek creativeabhishekg...@gmail.com added the comment:
I think New features like inflateReset2(), inflateMark(), or Z_TREES
flags are included in python 3.2.2.
--
nosy: +abhishek_bits
___
Python tracker rep...@bugs.python.org
Nadeem Vawda nadeem.va...@gmail.com added the comment:
No, the latest revision of Modules/zlibmodule.c doesn't use any of these
new features.
--
___
Python tracker rep...@bugs.python.org
http://bugs.python.org/issue8536
Nick Coghlan ncogh...@gmail.com added the comment:
Antoine's review picked up on several issues I missed or glossed over - I
actually agree with his point about making most of the new APIs private rather
than public.
With regards to exposing _testbuffer in the documentation of memoryview's
Antoine Pitrou pit...@free.fr added the comment:
With regards to exposing _testbuffer in the documentation of
memoryview's hash support, perhaps it would be better to use a 1D
bytes object + memoryview.cast() to get an officially supported
multi-dimensional view of a region of memory?
By
Tim Willis schadenfreude...@gmail.com added the comment:
Attaching a patch which merges aliases code from 3.2 back into 2.7.
--
keywords: +patch
Added file: http://bugs.python.org/file24339/argparse_aliases.patch
___
Python tracker
Benjamin Peterson benja...@python.org added the comment:
Thank you for handling this, Antoine!
--
___
Python tracker rep...@bugs.python.org
http://bugs.python.org/issue13885
___
Tim Willis schadenfreude...@gmail.com added the comment:
adding package author to nosy list
--
nosy: +bethard
___
Python tracker rep...@bugs.python.org
http://bugs.python.org/issue13879
___
sbt shibt...@gmail.com added the comment:
Quite honestly I don't like the way that polling a pipe reads a partial message
from the pipe. If at all possible, polling should not modify the pipe.
I think the cleanest thing would be to switch to byte oriented pipes on Windows
and create PipeIO
Roundup Robot devn...@psf.upfronthosting.co.za added the comment:
New changeset 089a086252fc by Benjamin Peterson in branch '3.2':
note that get() is not affected by default_factory (closes #13887)
http://hg.python.org/cpython/rev/089a086252fc
New changeset 26612ad451ad by Benjamin Peterson in
Nick Coghlan ncogh...@gmail.com added the comment:
Branch status update:
- Text Sequence Types section updated to reflect the new structure
- changed the prose that describes the relationship between printf-style
formatting and the str.format method (deliberately removing the implication
that
Nick Coghlan ncogh...@gmail.com added the comment:
One other things the branch doesn't currently sort out is the official
signature of count() and index().
In 3.2, for *all* of str, bytes, bytearray, tuple, list, range, the index()
method takes the optional start:stop parameters.
New submission from Samuel Iseli samuel.is...@gmail.com:
We are using python as an embedded scripting environment in our ERP-product.
Since upgrading to python2.7 we have serious issues with floats:
28710.0
'2870:.0'
round(28710.0)
2870.0
We are embedding Python in a Delphi-application.
The
Changes by Jesús Cea Avión j...@jcea.es:
--
nosy: +jcea
___
Python tracker rep...@bugs.python.org
http://bugs.python.org/issue13874
___
___
Python-bugs-list mailing list
Ezio Melotti ezio.melo...@gmail.com added the comment:
Have you considered/planned to rework a bit the beginning of the page too?
(Technically the issue is about the Sequence types section, but the whole page
could be improved.)
IMHO the sections about Truth value testing, Boolean operations,
Changes by Eric V. Smith e...@trueblade.com:
--
nosy: +eric.smith, mark.dickinson
___
Python tracker rep...@bugs.python.org
http://bugs.python.org/issue13889
___
___
STINNER Victor victor.stin...@haypocalc.com added the comment:
Oh, you can also try something else: add the volatile keyword.
--
___
Python tracker rep...@bugs.python.org
http://bugs.python.org/issue13874
___
New submission from Antoine Pitrou pit...@free.fr:
I don't know if these are related to the latest changes, but they only appear
on the 3.3 buildbots:
==
FAIL: test_case_insensitivity
New submission from John Zimmerman johzi...@cisco.com:
Python's socket module as included in Ubuntu Lucid (python version 2.6.5) does
not correctly handle and exclude malformed UDP packets. This means that UDP
listening programs written in python on this version are susceptible to
Jim Jewett jimjjew...@gmail.com added the comment:
On Thu, Jan 26, 2012 at 8:19 PM, Antoine Pitrou rep...@bugs.python.org wrote:
If I read your [Martin v. Löwis' ] patch correctly, collisions will
produce additional allocations ... That's a pretty massive
change in memory consumption for
Antoine Pitrou pit...@free.fr added the comment:
What do you call malformed UDP packets and how should they be detected by the
library?
--
nosy: +pitrou
___
Python tracker rep...@bugs.python.org
http://bugs.python.org/issue13891
John Zimmerman johzi...@cisco.com added the comment:
Thanks for your quick response, I downloaded the ISIC tool and used the
following command to identify the problem:
udpsic -s rand -d server-ip-address,port
where port is 514 (syslogd) which uses a python script to process the incoming
Antoine Pitrou pit...@free.fr added the comment:
But what does the ISIC tool report and why do you think it is a problem in
Python's socket module?
As far as I can read on its website, ISIC is a suite of utilities to exercise
the stability of an IP Stack and its component stacks (TCP, UDP,
John Zimmerman johzi...@cisco.com added the comment:
Hi Antoine,
The issue is that the CPU spikes to ~90% utilization for the server during the
attack, for as long as the attack lasts. So the theory is that Python isn't
throttling or processing the malformed packets properly. Copying
Antoine Pitrou pit...@free.fr added the comment:
The issue is that the CPU spikes to ~90% utilization for the server
during the attack, for as long as the attack lasts. So the theory is
that Python isn't throttling or processing the malformed packets
properly. Copying Renier for any
Sandro Tosi sandro.t...@gmail.com added the comment:
There are a lot more occurrences of 'floating point' in our doc: are you going
to fix them too?
--
nosy: +sandro.tosi
___
Python tracker rep...@bugs.python.org
http://bugs.python.org/issue13868
Mark Dickinson dicki...@gmail.com added the comment:
Samuel, can you regenerate your patch? The contents don't look right---I see
changes to pyport.h, but none to floatobject.c (and some other
spurious-looking changes to the project file).
--
___
Martin v. Löwis mar...@v.loewis.de added the comment:
I *am* a bit concerned that the possible contents of a dictentry
change; this could cause easily-missed-in-testing breakage for
anything that treats table as an array.
This is indeed a concern: the new code needs to be exercised.
I came
Charles-François Natali neolo...@free.fr added the comment:
I don't want to be harsh, but this whole report just doesn't make sense
You're getting 90% CPU usage simply because you're flooding your server.
Closing.
--
nosy: +neologix
resolution: - invalid
stage: - committed/rejected
Changes by Mark Dickinson dicki...@gmail.com:
--
nosy: +mark.dickinson
___
Python tracker rep...@bugs.python.org
http://bugs.python.org/issue13868
___
___
Charles-François Natali neolo...@free.fr added the comment:
Could you please indicate exactly the command you're running, and provide the
full backtrace?
--
nosy: +neologix
___
Python tracker rep...@bugs.python.org
abhishek creativeabhishekg...@gmail.com added the comment:
Check This out
http://hg.python.org/cpython/file/b99c54acb22d/Modules/zlib/inflate.c
http://hg.python.org/cpython/file/b99c54acb22d/Modules/zlib/zconf.h
http://hg.python.org/cpython/file/b99c54acb22d/Modules/zlib/zconf.in.h
All three
Mark Dickinson dicki...@gmail.com added the comment:
I'm a bit disturbed that we're not using the _Py_SET_53BIT_PRECISION_* macros
in _Py_double_round; unless I'm missing something, that seems like a major
omission.
--
___
Python tracker
Antoine Pitrou pit...@free.fr added the comment:
[Martin's approach]
The point I first missed is that this triggers only when the hash is
*fully* equal; if the hashes are merely equal after masking, then
today's try-another-slot approach will still be used, even for
strings.
But then isn't
Changes by Mark Dickinson dicki...@gmail.com:
--
type: - behavior
versions: +Python 3.2, Python 3.3 -Python 3.1
___
Python tracker rep...@bugs.python.org
http://bugs.python.org/issue13889
___
Changes by Patrick Hahn sko...@gmail.com:
--
nosy: +skorgu
___
Python tracker rep...@bugs.python.org
http://bugs.python.org/issue13703
___
___
Python-bugs-list mailing
Martin v. Löwis mar...@v.loewis.de added the comment:
But then isn't it vulnerable to Frank's first attack as exposed in
http://mail.python.org/pipermail/python-dev/2012-January/115726.html ?
It would be, yes. That's sad.
That could be fixed by indeed creating trees in all cases (i.e. moving
New submission from Jack Jansen jackjan...@users.sourceforge.net:
I found a problem with the handling of manifest files in the msvc9compiler.
Distutils removes the reference to the MSVC runtime from the manifest resource,
to enable installing the runtime system locally (i.e. to allow
Roundup Robot devn...@psf.upfronthosting.co.za added the comment:
New changeset 5b884955 by Mark Dickinson in branch '3.2':
Issue #13889: Add missing _Py_SET_53BIT_PRECISION_* calls around uses of dtoa.c
functions in float round.
http://hg.python.org/cpython/rev/5b884955
New changeset
Brett Cannon br...@python.org added the comment:
I was getting that error the other day on my OS X laptop, but then I thought I
tweaked the code well enough to solve it (since I am running on a
case-insensitive filesystem as well). It seems to stem from what nt.environ
contains when the test
Mark Dickinson dicki...@gmail.com added the comment:
but none to floatobject.c
Bah, reading comprehension fail. Now that I look at your patch again, the
floatobject.c changes are there (and pretty much match what I just committed).
I assume that the changes to pythoncore.vcproj can be
Changes by Mark Dickinson dicki...@gmail.com:
--
priority: high - normal
___
Python tracker rep...@bugs.python.org
http://bugs.python.org/issue13889
___
___
Brett Cannon br...@python.org added the comment:
Otherwise it's the nt.listdir() comparison that's failing. Probably should
check that is returning reasonable stuff as well.
--
___
Python tracker rep...@bugs.python.org
Stefan Krah stefan-use...@bytereef.org added the comment:
I've added some comments on Rietveld. This time, I pasted the email
addresses manually into the CC field, apparently without success
(I didn't receive mail).
Regarding the use of _testbuffer in the docs: I agree that it's strange,
on the
Dave Malcolm dmalc...@redhat.com added the comment:
On Fri, 2012-01-27 at 21:02 +, Martin v. Löwis wrote:
Martin v. Löwis mar...@v.loewis.de added the comment:
But then isn't it vulnerable to Frank's first attack as exposed in
Antoine Pitrou pit...@free.fr added the comment:
Well apparently nt.environ doesn't reflect os.environ:
os.environ['PYTHONCASEOK'] = '1'
nt.environ['PYTHONCASEOK']
Traceback (most recent call last):
File stdin, line 1, in module
KeyError: 'PYTHONCASEOK'
nt.environ[b'PYTHONCASEOK']
Arfrever Frehtes Taifersar Arahesis arfrever@gmail.com added the comment:
Modules/zlib directory contains only bundled copy of zlib-1.2.5.
zlib Python module uses Modules/zlibmodule.c file.
--
nosy: +Arfrever
versions: +Python 3.3 -Python 3.2
___
Steven Bethard steven.beth...@gmail.com added the comment:
This is a new feature, not a bug, so I think the correct fix is to change the
2.7 documentation, since at this point 2.7 can only get bugfixes, not new
features.
--
___
Python tracker
Changes by Arfrever Frehtes Taifersar Arahesis arfrever@gmail.com:
--
nosy: +Arfrever
___
Python tracker rep...@bugs.python.org
http://bugs.python.org/issue13882
___
Alexander Belopolsky alexander.belopol...@gmail.com added the comment:
Can we pick an API for this functionality that does not follow the worst of
design anti-patterns? Constant arguments, varying return type, hidden import,
and the list can go on.
What is wrong with simply creating a new
Stefan Krah stefan-use...@bytereef.org added the comment:
Yes, volatile works, too. That's probably the best solution.
--
___
Python tracker rep...@bugs.python.org
http://bugs.python.org/issue13874
___
Antoine Pitrou pit...@free.fr added the comment:
Well, creating a separate module is an anti-pattern in itself. calendar vs.
time vs. datetime, anyone?
I would instead propose separate functions: decimal_time, decimal_clock... or,
if you prefer, time_decimal and so on.
--
nosy:
Stefan Krah stefan-use...@bytereef.org added the comment:
Well, to be completely unambiguous. This works:
diff -r d2cf8a34ddf9 Modules/faulthandler.c
--- a/Modules/faulthandler.cThu Jan 26 00:15:07 2012 -0800
+++ b/Modules/faulthandler.cFri Jan 27 23:16:27 2012 +0100
@@ -943,7 +943,7 @@
Alexander Belopolsky alexander.belopol...@gmail.com added the comment:
On Fri, Jan 27, 2012 at 5:17 PM, Antoine Pitrou rep...@bugs.python.org wrote:
Well, creating a separate module is an anti-pattern in itself. calendar vs.
time vs. datetime, anyone?
Are you serious? Since the invention of
Antoine Pitrou pit...@free.fr added the comment:
Are you serious? Since the invention of structural programming,
creating a separate module for distinct functionality has been one of
the most powerful design techniques.
Yes, I'm serious, and I don't see what structural programming or design
Changes by Alexander Belopolsky alexander.belopol...@gmail.com:
--
nosy: +mark.dickinson
___
Python tracker rep...@bugs.python.org
http://bugs.python.org/issue13882
___
Terry J. Reedy tjre...@udel.edu added the comment:
We are aware that key-binding deletion is not working correctly.
I am pretty sure this report has the same underlying issue as #4765.
--
nosy: +serwy, terry.reedy
resolution: - duplicate
status: open - closed
superseder: - IDLE fails
Terry J. Reedy tjre...@udel.edu added the comment:
#13836 is another report of key-binding deletion not working correctly,
although IDLE did eventually open and allow re-deletion.
--
___
Python tracker rep...@bugs.python.org
Changes by Terry J. Reedy tjre...@udel.edu:
--
nosy: +georg.brandl
stage: - test needed
versions: -Python 2.6, Python 2.7, Python 3.1, Python 3.2, Python 3.4
___
Python tracker rep...@bugs.python.org
http://bugs.python.org/issue13839
Changes by Terry J. Reedy tjre...@udel.edu:
--
stage: - test needed
versions: -Python 3.2
___
Python tracker rep...@bugs.python.org
http://bugs.python.org/issue13841
___
New submission from Giovanni Funchal gafunc...@gmail.com:
GIHTTPServer.py is a very handy module for quickly setting up a full HTTP
server with CGI support. However, I noticed that it doesn't support responses
other than 200 OK. So, for instance if the page wants to do a redirect
(response
Changes by Eric V. Smith e...@trueblade.com:
--
nosy: +eric.smith
___
Python tracker rep...@bugs.python.org
http://bugs.python.org/issue13882
___
___
Python-bugs-list
Terry J. Reedy tjre...@udel.edu added the comment:
Do we actually yet another function, or could this be covered by adding a
parameter such as monotonic=False, perhaps to wallclock().
--
nosy: +terry.reedy
stage: - patch review
type: - enhancement
Changes by Terry J. Reedy tjre...@udel.edu:
--
stage: - needs patch
type: - enhancement
___
Python tracker rep...@bugs.python.org
http://bugs.python.org/issue13847
___
Terry J. Reedy tjre...@udel.edu added the comment:
See also #13849
--
nosy: +terry.reedy
___
Python tracker rep...@bugs.python.org
http://bugs.python.org/issue13848
___
Terry J. Reedy tjre...@udel.edu added the comment:
This is a bit related to #13848 files 2 seconds earlier.
--
nosy: +terry.reedy
___
Python tracker rep...@bugs.python.org
http://bugs.python.org/issue13849
___
Changes by Terry J. Reedy tjre...@udel.edu:
--
nosy: +orsenthil
stage: - test needed
type: - enhancement
versions: -Python 2.7, Python 3.1, Python 3.2, Python 3.4
___
Python tracker rep...@bugs.python.org
http://bugs.python.org/issue13866
Antoine Pitrou pit...@free.fr added the comment:
Well, adding tests is certainly useful to avoid regressions in CPython (not
only PyPy or Jython). It seems to me that the only reasonable discussion is
whether they should be committed to 2.7 and 3.2, or only the default branch.
(I personally
Changes by Terry J. Reedy tjre...@udel.edu:
--
components: +Library (Lib) -Documentation, Extension Modules
nosy: +fdrake, pitrou
___
Python tracker rep...@bugs.python.org
http://bugs.python.org/issue13867
___
Antoine Pitrou pit...@free.fr added the comment:
Ha, good catch. The macro could be fixed, or the comment simply be dropped.
--
versions: +Python 2.7, Python 3.2, Python 3.3
___
Python tracker rep...@bugs.python.org
http://bugs.python.org/issue13867
Changes by Antoine Pitrou pit...@free.fr:
--
nosy: +orsenthil
___
Python tracker rep...@bugs.python.org
http://bugs.python.org/issue13893
___
___
Python-bugs-list mailing
Nick Coghlan ncogh...@gmail.com added the comment:
Yeah, the basic layout of this entire section has been in place for a *long*
time
(http://docs.python.org/release/1.4/lib/node4.html#SECTION0031)
Some aspects haven't really aged all that well, as people have made minimalist
Jesús Cea Avión j...@jcea.es added the comment:
I think this support should be backported to Python 2.7 and 3.2. Current code
can't decompress files generated by pbzip2, fairly popular. I would consider
that a bug, not a feature request.
I am just recompressing a 77GB file because of this
Nick Coghlan ncogh...@gmail.com added the comment:
Radical suggestion: make it public as collections.simple_ndarray?
(prefixing with simple_ to be explicit that this is not even *close* to being
the all-singing, all-dancing NumPy.ndarray)
--
___
Changes by Jesús Cea Avión j...@jcea.es:
--
nosy: +jcea
___
Python tracker rep...@bugs.python.org
http://bugs.python.org/issue13877
___
___
Python-bugs-list mailing list
Changes by Jesús Cea Avión j...@jcea.es:
--
nosy: +jcea
___
Python tracker rep...@bugs.python.org
http://bugs.python.org/issue1003195
___
___
Python-bugs-list mailing
Benjamin Peterson benja...@python.org added the comment:
For the record, Barry and I agreed on what we'll be doing for stable releases
[1]. David says he should have a patch soon.
[1] http://mail.python.org/pipermail/python-dev/2012-January/115892.html
--
Roger Serwy roger.se...@gmail.com added the comment:
I am unable to reproduce this bug with the latest development versions in the
2.7 and 3.3 branches.
Can someone verify this as well?
--
___
Python tracker rep...@bugs.python.org
Jesús Cea Avión j...@jcea.es added the comment:
That makes x and y volatile.
--
___
Python tracker rep...@bugs.python.org
http://bugs.python.org/issue13874
___
___
1 - 100 of 104 matches
Mail list logo
