Infinite recursion with ast module - ebranca/owasp-pysec GitHub Wiki

Classification

import ast

e = ast.UnaryOp(op=ast.Not(), lineno=0, col_offset=0)

e.operand = e

compile(ast.Expression(e), "<test>", "eval")

To reproduce the problem copy the source code in a file and execute the script using the following command syntax:

$ python -OOBRtt test.py

Alternatively you can open python in interactive mode:

$ python -OOBRtt <press enter>

Then copy the lines of code into the interpreter.

The sample source code uses the module ast and generates an error in the core libraries that leads to an interpreter crash or Segmentation fault.

python -OOBRtt 'test.py' 
Segmentation fault

The test code generates an infinite recursion that is a condition non handled by python and as a conseguence the interpreter crashed.

Python does not have cycle detection code or system do add recursion limits dynamically based on the system resources.

We are not aware on any easy solution other than trying to avoid using 'ast' in cases like the one examined.