From 0b14f243c4ba95db67604261131400cd92736df9 Mon Sep 17 00:00:00 2001 From: Brett Cannon Date: Sun, 30 Sep 2007 19:45:10 +0000 Subject: [PATCH] tuple.__repr__ did not consider a reference loop as it is not possible from Python code; but it is possible from C. object.__str__ had the issue of not expecting a type to doing something within it's tp_str implementation that could trigger an infinite recursion, but it could in C code.. Both found thanks to BaseException and how it handles its repr. Closes issue #1686386. Thanks to Thomas Herve for taking an initial stab at coming up with a solution. --- Misc/NEWS | 6 ++++++ Objects/object.c | 5 +++++ Objects/tupleobject.c | 13 +++++++++++++ 3 files changed, 24 insertions(+) diff --git a/Misc/NEWS b/Misc/NEWS index 2dadbbfeca4..b01633abda3 100644 --- a/Misc/NEWS +++ b/Misc/NEWS @@ -12,6 +12,12 @@ What's New in Python 2.6 alpha 1? Core and builtins ----------------- +- Issue #1686386: Tuple's tp_repr did not take into account the possibility of + having a self-referential tuple, which is possible from C code. Nor did + object's tp_str consider that a type's tp_str could do something that could + lead to an inifinite recursion. Py_ReprEnter() and Py_EnterRecursiveCall(), + respectively, fixed the issues. + - Issue #1164: It was possible to trigger deadlock when using the 'print' statement to write to a file since the GIL was not released as needed. Now PyObject_Print() does the right thing along with various tp_print diff --git a/Objects/object.c b/Objects/object.c index 0651d6b6d87..e75a03d1852 100644 --- a/Objects/object.c +++ b/Objects/object.c @@ -408,7 +408,12 @@ _PyObject_Str(PyObject *v) if (Py_Type(v)->tp_str == NULL) return PyObject_Repr(v); + /* It is possible for a type to have a tp_str representation that loops + infinitely. */ + if (Py_EnterRecursiveCall(" while getting the str of an object")) + return NULL; res = (*Py_Type(v)->tp_str)(v); + Py_LeaveRecursiveCall(); if (res == NULL) return NULL; type_ok = PyString_Check(res); diff --git a/Objects/tupleobject.c b/Objects/tupleobject.c index b85762a7434..38304dda18f 100644 --- a/Objects/tupleobject.c +++ b/Objects/tupleobject.c @@ -216,6 +216,15 @@ tuplerepr(PyTupleObject *v) PyObject *s, *temp; PyObject *pieces, *result = NULL; + /* While not mutable, it is still possible to end up with a cycle in a + tuple through an object that stores itself within a tuple (and thus + infinitely asks for the repr of itself). This should only be + possible within a type. */ + i = Py_ReprEnter((PyObject *)v); + if (i != 0) { + return i > 0 ? PyString_FromString("(...)") : NULL; + } + n = Py_Size(v); if (n == 0) return PyString_FromString("()"); @@ -226,7 +235,10 @@ tuplerepr(PyTupleObject *v) /* Do repr() on each element. */ for (i = 0; i < n; ++i) { + if (Py_EnterRecursiveCall(" while getting the repr of a tuple")) + goto Done; s = PyObject_Repr(v->ob_item[i]); + Py_LeaveRecursiveCall(); if (s == NULL) goto Done; PyTuple_SET_ITEM(pieces, i, s); @@ -261,6 +273,7 @@ tuplerepr(PyTupleObject *v) Done: Py_DECREF(pieces); + Py_ReprLeave((PyObject *)v); return result; }