From: Brett Cannon <bcannon@gmail.com>
Date: Tue, 13 Jun 2006 21:46:41 +0000 (+0000)
Subject: If a classic class defined a __coerce__() method that just returned its two
X-Git-Tag: v2.5b1~72
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=ea3912b0da71e16b8a37e04fcf3969dc85c27fa1;p=thirdparty%2FPython%2Fcpython.git

If a classic class defined a __coerce__() method that just returned its two
arguments in reverse, the interpreter would infinitely recourse trying to get a
coercion that worked.  So put in a recursion check after a coercion is made and
the next call to attempt to use the coerced values.

Fixes bug #992017 and closes crashers/coerce.py .
---

diff --git a/Lib/test/crashers/coerce.py b/Lib/test/crashers/coerce.py
deleted file mode 100644
index 574956b228ef..000000000000
--- a/Lib/test/crashers/coerce.py
+++ /dev/null
@@ -1,9 +0,0 @@
-
-# http://python.org/sf/992017
-
-class foo:
-    def __coerce__(self, other):
-        return other, self
-
-if __name__ == '__main__':
-    foo()+1   # segfault: infinite recursion in C
diff --git a/Misc/NEWS b/Misc/NEWS
index 82838f3d0020..d7dfb8fc624b 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -12,6 +12,9 @@ What's New in Python 2.5 beta 1?
 Core and builtins
 -----------------
 
+- Bug #992017: A classic class that defined a __coerce__() method that returned
+  its arguments swapped would infinitely recurse and segfault the interpreter.
+
 - Fix the socket tests so they can be run concurrently.
 
 - Removed 5 integers from C frame objects (PyFrameObject).
diff --git a/Objects/classobject.c b/Objects/classobject.c
index 9e57269d24d0..c69ba744e62f 100644
--- a/Objects/classobject.c
+++ b/Objects/classobject.c
@@ -1368,10 +1368,13 @@ half_binop(PyObject *v, PyObject *w, char *opname, binaryfunc thisfunc,
 		 * argument */
 		result = generic_binary_op(v1, w, opname);
 	} else {
+		if (Py_EnterRecursiveCall(" after coercion"))
+		    return NULL;
 		if (swapped)
 			result = (thisfunc)(w, v1);
 		else
 			result = (thisfunc)(v1, w);
+		Py_LeaveRecursiveCall();
 	}
 	Py_DECREF(coerced);
 	return result;