Macaulay2 / Macaulay2/M2

Exploit unlocking reassignment for any protected object

Open
#4,493 1 comment 0 reactions 0 assignees View on GitHub
Interpreter
Dominant language
Macaulay2
Stars
435
Forks
297
Avg merge
4d 20h
Merged PRs (30d)
11

Description

I've found a funny bug that removes the protection guard from arbitrary object

```macaulay2
Macaulay2, version 1.26.06-2-g1a37f6fe95-dirty (makepkg)
Type "help" to see useful commands

i1 : H >> Thing := 196883
stdio:1:5:(3):[1]: error: no method for binary operator >> applied to objects:
List (of class Type)
>> 196883 (of class ZZ)

i2 : << Thing + 1|" = "|Thing|" + 1";
196884 = 196883 + 1
```
This probably caused by the low precedence of `>>` causing the execution to go in the reversed order, including runtime errors handlers.

The minimal code making it work that I've found is: `H>>pi:=3`, and the pattern seems to work on any objects - regardless of it being protected or not, the assignment from rhs gets always executed, here causing the biggest engineers' dream to come true:
```macaulay2
i1 : H>>pi:=3
stdio:1:1:(3):[1]: error: no method for binary operator >> applied to objects:
H (of class Symbol)
>> 3 (of class ZZ)

i2 : pi == 3

o2 = true
```

Contributor guide

No contributing guide indexed for this repository

Research direction

Begin with the minimal reproducer H>>pi:=3 and compare its behavior with the reported runtime error and subsequent pi == 3 result. Trace parsing and operator-precedence handling for >>, including error paths, then add a regression test showing that a failed reassignment cannot modify protected or arbitrary objects.

Written by the indexing model from the issue text.

Assessment

Domain
compilers
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.