New submission from Petr Viktorin <encu...@gmail.com>:

The `replace` method of `code` allows setting e.g.
* co_filename to a subclass of str
* co_consts to an arbitrary tuple
and possibly more weird cases.

This makes code objects unmarshallable.

One way to create such a code object is to call `compileall.compile_file` with 
a str subclass as path. See the attached reproducers.

This hit pip, see: https://github.com/pypa/pip/pull/10358#issuecomment-914320728

----------
files: reproducer_replace.py
messages: 401277
nosy: petr.viktorin
priority: normal
severity: normal
status: open
title: Code objects can contain unmarshallable objects
Added file: https://bugs.python.org/file50268/reproducer_replace.py

_______________________________________
Python tracker <rep...@bugs.python.org>
<https://bugs.python.org/issue45127>
_______________________________________
_______________________________________________
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

Reply via email to