1 files changed, 129 insertions, 0 deletions
diff --git a/lang/python26/patches/patch-CVE-2012-1150-Lib_test_test_hash.py b/lang/python26/patches/patch-CVE-2012-1150-Lib_test_test_hash.py
new file mode 100644
index 00000000000..2b8be5f5308
--- /dev/null
+++ b/lang/python26/patches/patch-CVE-2012-1150-Lib_test_test_hash.py
@@ -0,0 +1,129 @@
+$NetBSD: patch-CVE-2012-1150-Lib_test_test_hash.py,v 1.1 2012/03/25 09:09:05 tron Exp $
+
+Fix for CVE-2012-1150 taken from here:
+
+http://hg.python.org/cpython/rev/6b7704fe1be1
+
+--- Lib/test/test_hash.py.orig	2008-12-30 01:36:00.000000000 +0000
++++ Lib/test/test_hash.py	2012-03-25 09:51:50.000000000 +0100
+@@ -3,10 +3,18 @@
+ #
+ # Also test that hash implementations are inherited as expected
+ 
++import os
++import sys
++import struct
++import datetime
+ import unittest
++import subprocess
++
+ from test import test_support
+ from collections import Hashable
+ 
++IS_64BIT = (struct.calcsize('l') == 8)
++
+ 
+ class HashEqualityTestCase(unittest.TestCase):
+ 
+@@ -133,10 +141,100 @@
+         for obj in self.hashes_to_check:
+             self.assertEqual(hash(obj), _default_hash(obj))
+ 
++class HashRandomizationTests(unittest.TestCase):
++
++    # Each subclass should define a field "repr_", containing the repr() of
++    # an object to be tested
++
++    def get_hash_command(self, repr_):
++        return 'print(hash(%s))' % repr_
++
++    def get_hash(self, repr_, seed=None):
++        env = os.environ.copy()
++        if seed is not None:
++            env['PYTHONHASHSEED'] = str(seed)
++        else:
++            env.pop('PYTHONHASHSEED', None)
++        cmd_line = [sys.executable, '-c', self.get_hash_command(repr_)]
++        p = subprocess.Popen(cmd_line, stdin=subprocess.PIPE,
++                             stdout=subprocess.PIPE, stderr=subprocess.STDOUT,
++                             env=env)
++        out, err = p.communicate()
++        out = test_support.strip_python_stderr(out)
++        return int(out.strip())
++
++    def test_randomized_hash(self):
++        # two runs should return different hashes
++        run1 = self.get_hash(self.repr_, seed='random')
++        run2 = self.get_hash(self.repr_, seed='random')
++        self.assertNotEqual(run1, run2)
++
++class StringlikeHashRandomizationTests(HashRandomizationTests):
++    def test_null_hash(self):
++        # PYTHONHASHSEED=0 disables the randomized hash
++        if IS_64BIT:
++            known_hash_of_obj = 1453079729188098211
++        else:
++            known_hash_of_obj = -1600925533
++
++        # Randomization is disabled by default:
++        self.assertEqual(self.get_hash(self.repr_), known_hash_of_obj)
++
++        # It can also be disabled by setting the seed to 0:
++        self.assertEqual(self.get_hash(self.repr_, seed=0), known_hash_of_obj)
++
++    def test_fixed_hash(self):
++        # test a fixed seed for the randomized hash
++        # Note that all types share the same values:
++        if IS_64BIT:
++            h = -4410911502303878509
++        else:
++            h = -206076799
++        self.assertEqual(self.get_hash(self.repr_, seed=42), h)
++
++class StrHashRandomizationTests(StringlikeHashRandomizationTests):
++    repr_ = repr('abc')
++
++    def test_empty_string(self):
++        self.assertEqual(hash(""), 0)
++
++class UnicodeHashRandomizationTests(StringlikeHashRandomizationTests):
++    repr_ = repr(u'abc')
++
++    def test_empty_string(self):
++        self.assertEqual(hash(u""), 0)
++
++class BufferHashRandomizationTests(StringlikeHashRandomizationTests):
++    repr_ = 'buffer("abc")'
++
++    def test_empty_string(self):
++        self.assertEqual(hash(buffer("")), 0)
++
++class DatetimeTests(HashRandomizationTests):
++    def get_hash_command(self, repr_):
++        return 'import datetime; print(hash(%s))' % repr_
++
++class DatetimeDateTests(DatetimeTests):
++    repr_ = repr(datetime.date(1066, 10, 14))
++
++class DatetimeDatetimeTests(DatetimeTests):
++    repr_ = repr(datetime.datetime(1, 2, 3, 4, 5, 6, 7))
++
++class DatetimeTimeTests(DatetimeTests):
++    repr_ = repr(datetime.time(0))
++
++
+ def test_main():
+     test_support.run_unittest(HashEqualityTestCase,
+                               HashInheritanceTestCase,
+-                              HashBuiltinsTestCase)
++                              HashBuiltinsTestCase,
++                              StrHashRandomizationTests,
++                              UnicodeHashRandomizationTests,
++                              BufferHashRandomizationTests,
++                              DatetimeDateTests,
++                              DatetimeDatetimeTests,
++                              DatetimeTimeTests)
++                              
+ 
+ 
+ if __name__ == "__main__":