[ZCM] [ZC] 1617/ 6 Unrestrict "zpt code crashes zope"

[Collector: Zope Bugs, Features, and Patches ...]

Issue #1617 Update (Unrestrict) "zpt code crashes zope"
 ** Security Related ** (Public)
 Status Accepted, Zope/bug critical
To followup, visit:
  http://collector.zope.org/Zope/1617

==============================================================
= Unrestrict_accepted - Entry #6 by ajung on Dec 10, 2004 1:47 am


________________________________________
= Comment - Entry #5 by ajung on Dec 9, 2004 8:30 am

URL of Python bug report:

https://sourceforge.net/tracker/index.php?func=detail&aid=1082085&group_id=5470&atid=105470
________________________________________
= Comment - Entry #4 by ajung on Dec 9, 2004 7:55 am

This bug is reproducable with Python 2.3.4 and Python 2.4.0 
inside a Python-only environment. So this is definetely a bug
in Python...filing a Python bug report now.
________________________________________
= Assign_confidential - Entry #3 by ajung on Dec 9, 2004 7:47 am

 Status: Pending => Accepted

 Supporters added: ajung


________________________________________
= Comment - Entry #2 by ajung on Dec 9, 2004 7:42 am

I tracked this issue down.

Zope/Python segfaults in cAccessControl, line 2053

u'\xc4' is passed to PyString_AsString() which causes the crash.

No idea if this happens because of some reference counting problem...
trying to reproduce the error within a Python-only environment.
________________________________________
= Request - Entry #1 by jmo on Dec 9, 2004 7:22 am


Uploaded:  "unicode-crash.txt"
 - http://collector.zope.org/Zope/1617/unicode-crash.txt/view
the following ZPT code crashes zope (python hangs or dumps core) - see also the attachment

<tal:block define="
 items python: {u'\xc4': ''};
 key python: u'\xc4'"
content="items/?key" />
==============================================================