tuple.__repr__ did not consider a reference loop as it is not possible from

Python code; but it is possible from C.  object.__str__ had the issue of not
expecting a type to doing something within it's tp_str implementation that
could trigger an infinite recursion, but it could in C code..  Both found
thanks to BaseException and how it handles its repr.

Closes issue #1686386.  Thanks to Thomas Herve for taking an initial stab at
coming up with a solution.

diff --git a/Misc/NEWS b/Misc/NEWS
index 2dadbbfeca4e3beefb4d98b6076843df5482438d..b01633abda31cfd64e55b18e616e34377feef2af 100644 (file)
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -12,6 +12,12 @@ What's New in Python 2.6 alpha 1?
 Core and builtins
 -----------------
 
+- Issue #1686386: Tuple's tp_repr did not take into account the possibility of
+  having a self-referential tuple, which is possible from C code.  Nor did
+  object's tp_str consider that a type's tp_str could do something that could
+  lead to an inifinite recursion.  Py_ReprEnter() and Py_EnterRecursiveCall(),
+  respectively, fixed the issues.
+
 - Issue #1164: It was possible to trigger deadlock when using the 'print'
   statement to write to a file since the GIL was not released as needed.  Now
   PyObject_Print() does the right thing along with various tp_print

diff --git a/Objects/object.c b/Objects/object.c
index 0651d6b6d87bc5df54d9ffccecdc1b2236b18a24..e75a03d1852451892bb80b96e7669ef3b145bd3a 100644 (file)
--- a/Objects/object.c
+++ b/Objects/object.c
@@ -408,7 +408,12 @@ _PyObject_Str(PyObject *v)
        if (Py_Type(v)->tp_str == NULL)
                return PyObject_Repr(v);
 
+       /* It is possible for a type to have a tp_str representation that loops
+          infinitely. */
+       if (Py_EnterRecursiveCall(" while getting the str of an object"))
+               return NULL;
        res = (*Py_Type(v)->tp_str)(v);
+       Py_LeaveRecursiveCall();
        if (res == NULL)
                return NULL;
        type_ok = PyString_Check(res);

diff --git a/Objects/tupleobject.c b/Objects/tupleobject.c
index b85762a743457e2e5a65969d9e9b169f8b055720..38304dda18f16b3669e4a8df1481282befa2e89c 100644 (file)
--- a/Objects/tupleobject.c
+++ b/Objects/tupleobject.c
@@ -216,6 +216,15 @@ tuplerepr(PyTupleObject *v)
        PyObject *s, *temp;
        PyObject *pieces, *result = NULL;
 
+       /* While not mutable, it is still possible to end up with a cycle in a
+          tuple through an object that stores itself within a tuple (and thus
+          infinitely asks for the repr of itself). This should only be
+          possible within a type. */
+       i = Py_ReprEnter((PyObject *)v);
+       if (i != 0) {
+               return i > 0 ? PyString_FromString("(...)") : NULL;
+       }
+
        n = Py_Size(v);
        if (n == 0)
                return PyString_FromString("()");
@@ -226,7 +235,10 @@ tuplerepr(PyTupleObject *v)
 
        /* Do repr() on each element. */
        for (i = 0; i < n; ++i) {
+               if (Py_EnterRecursiveCall(" while getting the repr of a tuple"))
+                       goto Done;
                s = PyObject_Repr(v->ob_item[i]);
+               Py_LeaveRecursiveCall();
                if (s == NULL)
                        goto Done;
                PyTuple_SET_ITEM(pieces, i, s);
@@ -261,6 +273,7 @@ tuplerepr(PyTupleObject *v)
 
 Done:
        Py_DECREF(pieces);
+       Py_ReprLeave((PyObject *)v);
        return result;
 }