tuple.__repr__ did not consider a reference loop as it is not possible from
Python code; but it is possible from C. object.__str__ had the issue of not
expecting a type to doing something within it's tp_str implementation that
could trigger an infinite recursion, but it could in C code.. Both found
thanks to BaseException and how it handles its repr.
Closes issue #1686386. Thanks to Thomas Herve for taking an initial stab at
coming up with a solution.
diff --git a/Misc/NEWS b/Misc/NEWS
index 2dadbbf..b01633a 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -12,6 +12,12 @@
Core and builtins
-----------------
+- Issue #1686386: Tuple's tp_repr did not take into account the possibility of
+ having a self-referential tuple, which is possible from C code. Nor did
+ object's tp_str consider that a type's tp_str could do something that could
+ lead to an inifinite recursion. Py_ReprEnter() and Py_EnterRecursiveCall(),
+ respectively, fixed the issues.
+
- Issue #1164: It was possible to trigger deadlock when using the 'print'
statement to write to a file since the GIL was not released as needed. Now
PyObject_Print() does the right thing along with various tp_print
diff --git a/Objects/object.c b/Objects/object.c
index 0651d6b6..e75a03d 100644
--- a/Objects/object.c
+++ b/Objects/object.c
@@ -408,7 +408,12 @@
if (Py_Type(v)->tp_str == NULL)
return PyObject_Repr(v);
+ /* It is possible for a type to have a tp_str representation that loops
+ infinitely. */
+ if (Py_EnterRecursiveCall(" while getting the str of an object"))
+ return NULL;
res = (*Py_Type(v)->tp_str)(v);
+ Py_LeaveRecursiveCall();
if (res == NULL)
return NULL;
type_ok = PyString_Check(res);
diff --git a/Objects/tupleobject.c b/Objects/tupleobject.c
index b85762a..38304dd 100644
--- a/Objects/tupleobject.c
+++ b/Objects/tupleobject.c
@@ -216,6 +216,15 @@
PyObject *s, *temp;
PyObject *pieces, *result = NULL;
+ /* While not mutable, it is still possible to end up with a cycle in a
+ tuple through an object that stores itself within a tuple (and thus
+ infinitely asks for the repr of itself). This should only be
+ possible within a type. */
+ i = Py_ReprEnter((PyObject *)v);
+ if (i != 0) {
+ return i > 0 ? PyString_FromString("(...)") : NULL;
+ }
+
n = Py_Size(v);
if (n == 0)
return PyString_FromString("()");
@@ -226,7 +235,10 @@
/* Do repr() on each element. */
for (i = 0; i < n; ++i) {
+ if (Py_EnterRecursiveCall(" while getting the repr of a tuple"))
+ goto Done;
s = PyObject_Repr(v->ob_item[i]);
+ Py_LeaveRecursiveCall();
if (s == NULL)
goto Done;
PyTuple_SET_ITEM(pieces, i, s);
@@ -261,6 +273,7 @@
Done:
Py_DECREF(pieces);
+ Py_ReprLeave((PyObject *)v);
return result;
}