Merge from 3.1: Issue #13703: add a way to randomize the hash values of basic types (str, bytes, datetime)

in order to make algorithmic complexity attacks on (e.g.) web apps much more complicated.

The environment variable PYTHONHASHSEED and the new command line flag -R control this
behavior.

1 files changed, 13 insertions, 1 deletions

diff --git a/Python/dynload_win.c b/Python/dynload_win.c
index e7d61ce8e0..73a1dcf897 100644
--- a/Python/dynload_win.c
+++ b/Python/dynload_win.c
@@ -134,6 +134,15 @@ static char *GetPythonImport (HINSTANCE hModule)
                 !strncmp(import_name,"python",6)) {
                 char *pch;
 
+#ifndef _DEBUG
+                /* In a release version, don't claim that python3.dll is
+                   a Python DLL. */
+                if (strcmp(import_name, "python3.dll") == 0) {
+                    import_data += 20;
+                    continue;
+                }
+#endif
+
                 /* Ensure python prefix is followed only
                    by numbers to the end of the basename */
                 pch = import_name + 6;
@@ -162,13 +171,16 @@ static char *GetPythonImport (HINSTANCE hModule)
     return NULL;
 }
 
-
 dl_funcptr _PyImport_GetDynLoadFunc(const char *fqname, const char *shortname,
                                     const char *pathname, FILE *fp)
 {
     dl_funcptr p;
     char funcname[258], *import_python;
 
+#ifndef _DEBUG
+    _Py_CheckPython3();
+#endif
+
     PyOS_snprintf(funcname, sizeof(funcname), "PyInit_%.200s", shortname);
 
     {