Issue #28991: Fix obscure reentrancy bug in functools.lru_cache().

diff --git a/Lib/functools.py b/Lib/functools.py
index 214523cbc24cfccc9fc74116153ec87cce097491..60cf3c41876d80547126492ff1df4660d00e3d4b 100644 (file)
--- a/Lib/functools.py
+++ b/Lib/functools.py
@@ -516,14 +516,16 @@ def _lru_cache_wrapper(user_function, maxsize, typed, _CacheInfo):
                     last = root[PREV]
                     link = [last, root, key, result]
                     last[NEXT] = root[PREV] = cache[key] = link
-                    full = (len(cache) >= maxsize)
+                    # Use the __len__() method instead of the len() function
+                    # which could potentially be wrapped in an lru_cache itself.
+                    full = (cache.__len__() >= maxsize)
                 misses += 1
             return result
 
     def cache_info():
         """Report cache statistics"""
         with lock:
-            return _CacheInfo(hits, misses, maxsize, len(cache))
+            return _CacheInfo(hits, misses, maxsize, cache.__len__())
 
     def cache_clear():
         """Clear the cache and cache statistics"""

diff --git a/Lib/test/test_functools.py b/Lib/test/test_functools.py
index 6a3bf649633f8a7ef3fb3c519ab9c70695ad2d4d..b431e057648cae30c212b431d3e499c95a4f76d8 100644 (file)
--- a/Lib/test/test_functools.py
+++ b/Lib/test/test_functools.py
@@ -1,4 +1,5 @@
 import abc
+import builtins
 import collections
 import copy
 from itertools import permutations
@@ -1162,6 +1163,18 @@ class TestLRU:
         self.assertEqual(misses, 4)
         self.assertEqual(currsize, 2)
 
+    def test_lru_reentrancy_with_len(self):
+        # Test to make sure the LRU cache code isn't thrown-off by
+        # caching the built-in len() function.  Since len() can be
+        # cached, we shouldn't use it inside the lru code itself.
+        old_len = builtins.len
+        try:
+            builtins.len = self.module.lru_cache(4)(len)
+            for i in [0, 0, 1, 2, 3, 3, 4, 5, 6, 1, 7, 2, 1]:
+                self.assertEqual(len('abcdefghijklmn'[:i]), i)
+        finally:
+            builtins.len = old_len
+
     def test_lru_type_error(self):
         # Regression test for issue #28653.
         # lru_cache was leaking when one of the arguments

diff --git a/Misc/NEWS b/Misc/NEWS
index 806a603b907dae847ba1a6513cb115ee1aefb28e..073a9f7501cb44c5c81af4b3f2db3530099b57cf 100644 (file)
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -13,6 +13,9 @@ Core and Builtins
 - Issue #28512: Fixed setting the offset attribute of SyntaxError by
   PyErr_SyntaxLocationEx() and PyErr_SyntaxLocationObject().
 
+- Issue #28991:  functools.lru_cache() was susceptible to an obscure reentrancy
+  bug caused by a monkey-patched len() function.
+
 - Issue #28648: Fixed crash in Py_DecodeLocale() in debug build on Mac OS X
   when decode astral characters.  Patch by Xiang Zhang.