commit 13da1a60f13e173f65bb0da5ab325641d5bb99ec
author Oren Milman <orenmn@gmail.com> Tue Oct 03 00:31:42 2017 +0300
committer Serhiy Storchaka <storchaka@gmail.com> Tue Oct 03 00:31:42 2017 +0300
tree a0dc6bc230ec1d119c48a0ceecf3de33ef35ed64
parent 20cbc1d29facead32c2da06c81a09af0e057015c

[2.7] bpo-31478: Prevent unwanted behavior in _random.Random.seed() in case the arg has a bad __abs__() method (GH-3596) (#3845)

Lib/test/test_random.py

diff --git a/Lib/test/test_random.py b/Lib/test/test_random.py
index 90d334a..d2a4f21 100644
--- a/Lib/test/test_random.py
+++ b/Lib/test/test_random.py
@@ -307,6 +307,22 @@
 class MersenneTwister_TestBasicOps(TestBasicOps):
     gen = random.Random()
 
+    @test_support.cpython_only
+    def test_bug_31478(self):
+        # _random.Random.seed() should ignore the __abs__() method of a
+        # long/int subclass argument.
+        class BadInt(int):
+            def __abs__(self):
+                1/0
+        class BadLong(long):
+            def __abs__(self):
+                1/0
+        self.gen.seed(42)
+        expected_value = self.gen.random()
+        for seed_arg in [42L, BadInt(42), BadLong(42)]:
+            self.gen.seed(seed_arg)
+            self.assertEqual(self.gen.random(), expected_value)
+
     def test_setstate_first_arg(self):
         self.assertRaises(ValueError, self.gen.setstate, (1, None, None))
 

Misc/NEWS.d/next/Core and Builtins/2017-10-01-18-59-40.bpo-31478.owtqoO.rst

diff --git a/Misc/NEWS.d/next/Core and Builtins/2017-10-01-18-59-40.bpo-31478.owtqoO.rst b/Misc/NEWS.d/next/Core and Builtins/2017-10-01-18-59-40.bpo-31478.owtqoO.rst
new file mode 100644
index 0000000..b5b32d6
--- /dev/null
+++ b/Misc/NEWS.d/next/Core and Builtins/2017-10-01-18-59-40.bpo-31478.owtqoO.rst
@@ -0,0 +1,2 @@
+Prevent unwanted behavior in `_random.Random.seed()` in case the argument
+has a bad ``__abs__()`` method. Patch by Oren Milman.

Modules/_randommodule.c

diff --git a/Modules/_randommodule.c b/Modules/_randommodule.c
index 852b810..2e49db6 100644
--- a/Modules/_randommodule.c
+++ b/Modules/_randommodule.c
@@ -230,9 +230,15 @@
     }
     /* If the arg is an int or long, use its absolute value; else use
      * the absolute value of its hash code.
+     * Calling int.__abs__() or long.__abs__() prevents calling arg.__abs__(),
+     * which might return an invalid value. See issue #31478.
      */
-    if (PyInt_Check(arg) || PyLong_Check(arg))
-        n = PyNumber_Absolute(arg);
+    if (PyInt_Check(arg)) {
+        n = PyInt_Type.tp_as_number->nb_absolute(arg);
+    }
+    else if (PyLong_Check(arg)) {
+        n = PyLong_Type.tp_as_number->nb_absolute(arg);
+    }
     else {
         long hash = PyObject_Hash(arg);
         if (hash == -1)