Path: csiph.com!usenet.pasdenom.info!weretis.net!feeder4.news.weretis.net!feeds.phibee-telecom.net!newsfeed.xs4all.nl!newsfeed1.news.xs4all.nl!xs4all!post.news.xs4all.nl!not-for-mail
Return-Path: <ian.g.kelly@gmail.com>
X-Original-To: python-list@python.org
Delivered-To: python-list@mail.python.org
X-Spam-Status: OK 0.031
X-Spam-Evidence: '*H*': 0.94; '*S*': 0.00; 'subject:not': 0.03; 'default.': 0.09; 'exec': 0.09; 'reached.': 0.09; 'finney': 0.16; 'fork': 0.16; 'subject:run': 0.16; 'unsafe': 0.16; 'wrote:': 0.18; 'replacing': 0.19; 'thu,': 0.19; '>>>': 0.22; 'memory': 0.22; 'import': 0.22; 'second': 0.26; 'header:In-Reply-To:1': 0.27; 'am,': 0.29; 'message-id:@mail.gmail.com': 0.30; 'code': 0.31; '>>>>': 0.31; 'writes:': 0.31; 'know.': 0.32; 'run': 0.32; 'point.': 0.35; 'received:google.com': 0.35; 'so,': 0.37; 'ben': 0.38; 'to:addr:python-list': 0.38; 'to:addr:python.org': 0.39; 'dave': 0.60; "you'll": 0.62; 'mar': 0.68; 'limit': 0.70; 'subject:this': 0.83; '2015': 0.84; 'calls,': 0.84; 'race': 0.95
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :content-type:content-transfer-encoding; bh=MaNVyX1O5kpXC2LNZd3gioAexCVD4/RNtSlw2CVGWhQ=; b=G/x5bg2HSKML5YhWyLpSteGSf6xpdGytKohMywFmFvcuabNB8qqeybHrp7Xg7PDpB/ SQEMRDAeTpPgfM3rHuI/x13V0H72fGhRosrI6M3at64TN0Ev8Cd/Zuc6LKu4wf6mI1Qx K1jYp1Uhc0qoY0UU8BbhH5HNj1uy3j7P0fhDmpuxtwQVS9NG80VZ7/nBD+qLwyo4mysy oUQUhwmcDU4BEYWR0yPRCdyFJy+d670cyCTkk7hRju/tqALmuLmESIfZzHkDmNusdUwb S18Hu7pvl9RwU1nJezBZJqhqskypOcrxd+SjhYJfUfoNOpPgMcmv6DqYpfnNLEIZbqIK 8JrA==
X-Received: by 10.70.54.103 with SMTP id i7mr13797149pdp.114.1425542399560; Wed, 04 Mar 2015 23:59:59 -0800 (PST)
MIME-Version: 1.0
In-Reply-To: <gi1gfalrm71kqju9qcmcgus5pbseit2eqo@4ax.com>
References: <CAPTjJmoSgX6_HO16b2WB=vT+y8tys0ZyvcD-XVS+=6hj=gtUTQ@mail.gmail.com> <mailman.56.1425537863.21433.python-list@python.org> <gi1gfalrm71kqju9qcmcgus5pbseit2eqo@4ax.com>
From: Ian Kelly <ian.g.kelly@gmail.com>
Date: Thu, 5 Mar 2015 00:59:19 -0700
Subject: Re: Do not run this code.
To: Python <python-list@python.org>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-BeenThere: python-list@python.org
X-Mailman-Version: 2.1.19
Precedence: list
List-Id: General discussion list for the Python programming language <python-list.python.org>
List-Unsubscribe: <https://mail.python.org/mailman/options/python-list>, <mailto:python-list-request@python.org?subject=unsubscribe>
List-Archive: <http://mail.python.org/pipermail/python-list/>
List-Post: <mailto:python-list@python.org>
List-Help: <mailto:python-list-request@python.org?subject=help>
List-Subscribe: <https://mail.python.org/mailman/listinfo/python-list>, <mailto:python-list-request@python.org?subject=subscribe>
Newsgroups: comp.lang.python
Message-ID: <mailman.58.1425542402.21433.python-list@python.org>
Lines: 30
NNTP-Posting-Host: 2001:888:2000:d::a6
X-Trace: 1425542402 news.xs4all.nl 2971 [2001:888:2000:d::a6]:51826
X-Complaints-To: abuse@xs4all.nl
Xref: csiph.com comp.lang.python:86937

On Thu, Mar 5, 2015 at 12:39 AM, Dave Farrance
<DaveFarrance@omitthisyahooandthis.co.uk> wrote:
> Ben Finney <ben+python@benfinney.id.au> wrote:
>
>>Chris Angelico <rosuav@gmail.com> writes:
>>
>>> import base64; exec(=E2=80=A6)
>>
>>That's all I need to know. Code with =E2=80=98exec()=E2=80=99 calls, I co=
nsider unsafe
>>by default.
>
> Indeed. replacing exec with print...
>
>>>> print(base64.b64decode(b"eD0neD0lcjsgZXhlYyh4JSV4KSc7IGV4ZWMoeCV4KQ=3D=
=3D"))
> x=3D'x=3D%r; exec(x%%x)'; exec(x%x)
>
> so, discarding that second exec...
>
>>>> x=3D'x=3D%r; exec(x%%x)'
>>>> print(x)
> x=3D%r; exec(x%%x)
>
> So it recurses, and if that second exec had been left in then it would be
> a fork bomb.

In order to be a fork bomb, it would have to call fork at some point.
This is just a race to see whether you'll run out of memory before the
recursion limit is reached.