17
\$\begingroup\$

I would like to see who can make Python have a fatal crash with the most creative code. This means that when the program runs, Windows for example, will take over and pop up with something like “IDLE has stopped working”, or Linux will do whatever Linux does when a program crashes.

Rules:

  1. This must be made in Python 2.7 or above (So old bugs aren't exploited that have been fixed in future versions of Python).

  2. The definition of "crash" is "make IDLE or Python exit in an unintended way." This does not mean "make IDLE or Python halt and give a traceback". This also means exit, sys.quit, abort etc are not valid answers. For example, this will not be accepted:

    import sys
    try:
         print c # Crashes Here, as c is not defined.
     except NameError, SyntaxError:
         print "Oh No!"
         sys.exit()
    
  3. Making Python stop responding is not accepted.

  4. The code must be explained on what it does to crash. A link to a bug report is fine.

The most upvoted answer after 10 days wins! Begin!!

EDIT: May I make it clear that the objective is not to make Python just halt executing the program with a traceback. The objective is to make Python completely crash or stop working. This means that if this task is successfully accomplished, Windows would give this (I'm not crashing Word here, it's just an example of what should happen for a different program):

error dialogue

or this:

error dialogue 2

\$\endgroup\$
8
  • 1
    \$\begingroup\$ The tag code-challenge requires an objective winning criterion. I think most creative isn't objective enough... \$\endgroup\$
    – Howard
    Feb 27, 2014 at 19:16
  • \$\begingroup\$ Ok - Ill change it to as short as possible, like most other challenges.. Creative is quite ambiguous actually... \$\endgroup\$
    – George
    Feb 27, 2014 at 19:17
  • \$\begingroup\$ @GeorgeH If creative is what you were looking for, popularity-contest works perfectly. I personally feel that this would be best as a popularity contest. In the future, you can run your question through the sandbox where these kinks can be worked out before posting. \$\endgroup\$
    – Justin
    Feb 27, 2014 at 20:04
  • 2
    \$\begingroup\$ @People with High Rep, my prnt in the question is intentional. \$\endgroup\$
    – George
    Mar 1, 2014 at 1:11
  • 6
    \$\begingroup\$ I'm voting to close this question as off-topic because this question asks for malicious code. \$\endgroup\$ Aug 4, 2016 at 13:22

10 Answers 10

19
\$\begingroup\$

Should have been a code-golfing contest ;) - I guess the creativity is the statement the code makes: "I just don't know what's happening here..."

Copy and paste the following character in IDLE running on Windows:

𐒢

The crash has something to do with the character being encoded as UTF-16 by Windows and the unsuccessful conversion to a UTF-8 character by IDLE...

Edit: python bug #13153

\$\endgroup\$
4
  • \$\begingroup\$ I'm not sure if this is really a valid answer. The question says "when the program runs". But here the program is never really run. IDLE crashes when you merely paste the 𐒢, before you can even run it. \$\endgroup\$ Feb 28, 2014 at 17:08
  • \$\begingroup\$ Yeah, I have to agree with @Sebastian. In a Python program you start with a text file and run the Python interpreter on it, but it shouldn't matter how you make the text file. \$\endgroup\$
    – David Z
    Mar 1, 2014 at 6:11
  • 1
    \$\begingroup\$ Um... puu.sh/7eVar.png \$\endgroup\$
    – Oberon
    Mar 1, 2014 at 16:35
  • \$\begingroup\$ It works on Mac too! \$\endgroup\$
    – TheDoctor
    Mar 4, 2014 at 19:09
19
\$\begingroup\$

ctypes abuse:

import ctypes;ctypes.string_at(1)

This casts 1 to an address and dereferences it. On any sane system (i.e. one on which 0x00000001 is not a mapped address), this will segfault instantly.

\$\endgroup\$
2
  • \$\begingroup\$ On my machine, this doesn't seem to crash the interpreter. A traceback with a WindowsError error is displayed. \$\endgroup\$
    – Dhara
    Feb 28, 2014 at 8:14
  • \$\begingroup\$ @Dhara: Ah, that would be ctypes' structured exception handler catching the crash. I am certain you can crash Python with ctypes in Windows in some other way, but perhaps not in so few characters. \$\endgroup\$
    – nneonneo
    Feb 28, 2014 at 19:22
12
\$\begingroup\$

60

import sys
sys.setrecursionlimit(1<<30)
f=lambda f:f(f)
f(f)

Not my own idea. Copied from the Python Wiki here.

This causes an infinite recursion, and is not stopped by the interpreter because we changed the recursion limit.

\$\endgroup\$
2
  • \$\begingroup\$ Thanks - this is a great answer, but for the wrong question! The objective has not been clarified in the question. Thanks for your answer though. \$\endgroup\$
    – George
    Feb 27, 2014 at 21:58
  • 2
    \$\begingroup\$ @George H Sorry I'm not using a Windows machine now, but isn't a segmentation fault that causes the python interpreter to dump core enough? i.imgur.com/5gSGBpr.png \$\endgroup\$
    – user12205
    Feb 27, 2014 at 22:20
10
\$\begingroup\$

signal abuse (non-Windows only):

import os;os.kill(0,4)

On most systems (on which SIGILL = 4) this will kill Python with an "illegal instruction" error.

Or you can kill the program using the killer alarm clock:

import signal;signal.alarm(1)

After one second, Python dies with the cryptic message "Alarm clock".

\$\endgroup\$
1
  • \$\begingroup\$ Other single character signal codes that work include 1, 3, 5, 6, 8 and 9. \$\endgroup\$
    – user12205
    Feb 27, 2014 at 22:55
10
\$\begingroup\$

In Python 3.3:

exec(type((lambda:0).__code__)(0,1,0,0,0,b'',(),(),(),'','',1,b''))

In Python 2.7 code objects are slightly different:

exec type((lambda:0).func_code)(0,1,0,0,'Q',(),(),(),'','',0,'')

Yes, you can pass any old rubbish to the byte code interpreter and it executes it (Python issue #17187).

\$\endgroup\$
2
  • \$\begingroup\$ Shorter (Python 2.x): exec type((lambda:0).func_code)(0,1,0,0,'Q',(),(),(),'','',0,'') \$\endgroup\$
    – nneonneo
    Feb 27, 2014 at 22:52
  • \$\begingroup\$ Thanks! And in Python 3 we can use .__code__. \$\endgroup\$
    – user2186
    Feb 27, 2014 at 23:03
6
\$\begingroup\$

Recursive iterators use the C stack, not the Python stack (issue #14010 and issue #14507):

i=''
for _ in range(9**6):i=filter(int,i)
del i
\$\endgroup\$
1
  • \$\begingroup\$ This doesn't crash Python 2.7.11 on my Mac, but it does crash Python 3.5.1. \$\endgroup\$
    – nneonneo
    Aug 11, 2016 at 16:51
4
\$\begingroup\$

One easy way to crash the interpreter is to trick it into deallocating None:

import ctypes, sys
(ctypes.c_char*4).from_address(id(None))[:] = '\0'*4

As a bonus, here's a clever way to segfault Python 2:

import ctypes, struct, sys
inner = ()
outer = (inner,)
c_outer = (ctypes.c_char * sys.getsizeof(outer)).from_address(id(outer))
inner_index = c_outer[:].find(struct.pack('P', id(inner)))
c_outer[inner_index:inner_index+struct.calcsize('P')] = struct.pack('P', id(outer))
print outer

What exactly this does is left as an exercise to the reader.

\$\endgroup\$
1
  • 2
    \$\begingroup\$ First one: set refcount of None to zero, causing it to be deallocated hilariously. Second one: construct and print a self-referencing tuple. \$\endgroup\$
    – nneonneo
    Mar 3, 2014 at 17:51
3
\$\begingroup\$

Someone thought they could prevent new FlagsType objects from being created by setting FlagsType.tp_new = NULL, but they forgot to remove the method (issue #13204):

import sys
t=type(sys.flags)
t.__new__(t)

(sys.version_info has the same bug.)

\$\endgroup\$
3
\$\begingroup\$

Use of alloca in ctypes module (issue #13096):

from ctypes import *
POINTER('a'*9**8)
\$\endgroup\$
0
\$\begingroup\$

One possible way which crashes my Python with MemoryError:

x=[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]
\$\endgroup\$
2
  • 2
    \$\begingroup\$ This doesnt work for me - it just makes Python halt with a MemoryError. It needs to be closed by the OS. \$\endgroup\$
    – George
    Feb 27, 2014 at 19:24
  • 2
    \$\begingroup\$ Huh. The error happens at a surprisingly shallow depth. \$\endgroup\$ Feb 28, 2014 at 13:14

Not the answer you're looking for? Browse other questions tagged or ask your own question.