Fix a crasher where Python code managed to infinitely recurse in C code without

ever going back out to Python code in PyObject_Call().  Required introducing a
static RuntimeError instance so that normalizing an exception there is no
reliance on a recursive call that would put the exception system over the
recursion check itself.

diff --git a/Include/pyerrors.h b/Include/pyerrors.h
index ef7b2521d604d336b5dbc296f8325efdd0739e9c..a6ee840e23b6d8e292cf4679e1c19ced6de1323f 100644 (file)
--- a/Include/pyerrors.h
+++ b/Include/pyerrors.h
@@ -161,6 +161,7 @@ PyAPI_DATA(PyObject *) PyExc_VMSError;
 #endif
 
 PyAPI_DATA(PyObject *) PyExc_MemoryErrorInst;
+PyAPI_DATA(PyObject *) PyExc_RecursionErrorInst;
 
 /* Predefined warning categories */
 PyAPI_DATA(PyObject *) PyExc_Warning;

diff --git a/Lib/test/crashers/infinite_rec_1.py b/Lib/test/crashers/infinite_rec_1.py
deleted file mode 100644 (file)
index 573a509..0000000
--- a/Lib/test/crashers/infinite_rec_1.py
+++ /dev/null
@@ -1,11 +0,0 @@
-
-# http://python.org/sf/1202533
-
-import new, operator
-
-class A:
-    pass
-A.__mul__ = new.instancemethod(operator.mul, None, A)
-
-if __name__ == '__main__':
-    A()*2   # segfault: infinite recursion in C

diff --git a/Lib/test/crashers/infinite_rec_2.py b/Lib/test/crashers/infinite_rec_2.py
deleted file mode 100644 (file)
index 5a14b33..0000000
--- a/Lib/test/crashers/infinite_rec_2.py
+++ /dev/null
@@ -1,10 +0,0 @@
-
-# http://python.org/sf/1202533
-
-class A(str):
-    __get__ = getattr
-
-if __name__ == '__main__':
-    a = A('a')
-    A.a = a
-    a.a   # segfault: infinite recursion in C

diff --git a/Lib/test/crashers/infinite_rec_4.py b/Lib/test/crashers/infinite_rec_4.py
deleted file mode 100644 (file)
index 14f1520..0000000
--- a/Lib/test/crashers/infinite_rec_4.py
+++ /dev/null
@@ -1,7 +0,0 @@
-
-# http://python.org/sf/1202533
-
-if __name__ == '__main__':
-    lst = [apply]
-    lst.append(lst)
-    apply(*lst)      # segfault: infinite recursion in C

diff --git a/Lib/test/crashers/infinite_rec_5.py b/Lib/test/crashers/infinite_rec_5.py
deleted file mode 100644 (file)
index 18d2963..0000000
--- a/Lib/test/crashers/infinite_rec_5.py
+++ /dev/null
@@ -1,10 +0,0 @@
-
-# http://python.org/sf/1267884
-
-import types
-
-class C:
-    __str__ = types.InstanceType.__str__
-
-if __name__ == '__main__':
-    str(C())   # segfault: infinite recursion in C

diff --git a/Lib/test/test_descr.py b/Lib/test/test_descr.py
index 57cef44097218fca6054b77bea28a6beeb676492..9a45cf1760b75c9d2d68734fe94b014e358025e6 100644 (file)
--- a/Lib/test/test_descr.py
+++ b/Lib/test/test_descr.py
@@ -4,6 +4,7 @@ from test.test_support import verify, vereq, verbose, TestFailed, TESTFN, get_or
 from copy import deepcopy
 import warnings
 import types
+import new
 
 warnings.filterwarnings("ignore",
          r'complex divmod\(\), // and % are deprecated$',
@@ -1981,6 +1982,10 @@ def specials():
     unsafecmp(1, 1L)
     unsafecmp(1L, 1)
 
+def recursions():
+    if verbose:
+        print "Testing recursion checks ..."
+
     class Letter(str):
         def __new__(cls, letter):
             if letter == 'EPS':
@@ -1990,7 +1995,6 @@ def specials():
             if not self:
                 return 'EPS'
             return self
-
     # sys.stdout needs to be the original to trigger the recursion bug
     import sys
     test_stdout = sys.stdout
@@ -2004,6 +2008,17 @@ def specials():
         raise TestFailed, "expected a RuntimeError for print recursion"
     sys.stdout = test_stdout
 
+    # Bug #1202533.
+    class A(object):
+        pass
+    A.__mul__ = new.instancemethod(lambda self, x: self * x, None, A)
+    try:
+        A()*2
+    except RuntimeError:
+        pass
+    else:
+        raise TestFailed("expected a RuntimeError")
+
 def weakrefs():
     if verbose: print "Testing weak references..."
     import weakref
@@ -4395,6 +4410,7 @@ def test_main():
     overloading()
     methods()
     specials()
+    recursions()
     weakrefs()
     properties()
     supers()

diff --git a/Misc/NEWS b/Misc/NEWS
index 1f143491abc3185afeb1feb3dd36a1432ab3d6b4..1963a145d0b89b8d3918504ca9a5c6c1af18bb70 100644 (file)
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -12,6 +12,12 @@ What's New in Python 2.6 alpha 1?
 Core and builtins
 -----------------
 
+- Issue #1202533: Fix infinite recursion calls triggered by calls to
+  PyObject_Call() never calling back out to Python code to trigger recursion
+  depth updates/checks.  Required the creation of a static RuntimeError
+  instance in case normalizing an exception put the recursion check value past
+  its limit.  Fixes crashers infinite_rec_(1|2|4|5).py.
+
 - Patch #1031213: Decode source line in SyntaxErrors back to its original source
   encoding.
 

diff --git a/Objects/abstract.c b/Objects/abstract.c
index f7a3bfefb6cc6f20b8bdd1068b4d053138b76222..7378e0df118b47da6b9215c5b0af567fd31f4cdb 100644 (file)
--- a/Objects/abstract.c
+++ b/Objects/abstract.c
@@ -1857,7 +1857,11 @@ PyObject_Call(PyObject *func, PyObject *arg, PyObject *kw)
         ternaryfunc call;
 
        if ((call = func->ob_type->tp_call) != NULL) {
-               PyObject *result = (*call)(func, arg, kw);
+               PyObject *result;
+               if (Py_EnterRecursiveCall(" while calling a Python object"))
+                   return NULL;
+               result = (*call)(func, arg, kw);
+               Py_LeaveRecursiveCall();
                if (result == NULL && !PyErr_Occurred())
                        PyErr_SetString(
                                PyExc_SystemError,

diff --git a/Objects/exceptions.c b/Objects/exceptions.c
index 3d79383d3edae43f2f9a398144ea976e5e714a7e..64f655ceb07929b619bbb60707301015ce654de8 100644 (file)
--- a/Objects/exceptions.c
+++ b/Objects/exceptions.c
@@ -1912,6 +1912,12 @@ SimpleExtendsException(PyExc_Warning, UnicodeWarning,
  */
 PyObject *PyExc_MemoryErrorInst=NULL;
 
+/* Pre-computed RuntimeError instance for when recursion depth is reached.
+   Meant to be used when normalizing the exception for exceeding the recursion
+   depth will cause its own infinite recursion.
+*/
+PyObject *PyExc_RecursionErrorInst = NULL;
+
 /* module global functions */
 static PyMethodDef functions[] = {
     /* Sentinel */
@@ -2079,6 +2085,29 @@ _PyExc_Init(void)
     if (!PyExc_MemoryErrorInst)
         Py_FatalError("Cannot pre-allocate MemoryError instance\n");
 
+    PyExc_RecursionErrorInst = BaseException_new(&_PyExc_RuntimeError, NULL, NULL);
+    if (!PyExc_RecursionErrorInst)
+       Py_FatalError("Cannot pre-allocate RuntimeError instance for "
+                       "recursion errors");
+    else {
+       PyBaseExceptionObject *err_inst =
+           (PyBaseExceptionObject *)PyExc_RecursionErrorInst;
+       PyObject *args_tuple;
+       PyObject *exc_message;
+       exc_message = PyString_FromString("maximum recursion depth exceeded");
+       if (!exc_message)
+           Py_FatalError("cannot allocate argument for RuntimeError "
+                           "pre-allocation");
+       args_tuple = PyTuple_Pack(1, exc_message);
+       if (!args_tuple)
+           Py_FatalError("cannot allocate tuple for RuntimeError "
+                           "pre-allocation");
+       Py_DECREF(exc_message);
+       if (BaseException_init(err_inst, args_tuple, NULL))
+           Py_FatalError("init of pre-allocated RuntimeError failed");
+       Py_DECREF(args_tuple);
+    }
+
     Py_DECREF(bltinmod);
 
 #if defined _MSC_VER && _MSC_VER >= 1400 && defined(__STDC_SECURE_LIB__)

diff --git a/Objects/typeobject.c b/Objects/typeobject.c
index 49b877db0f30a961d5cab16dd29f2fcc2404aa95..59dec4a5d71e6fcd99da9afdd321047f75b0b150 100644 (file)
--- a/Objects/typeobject.c
+++ b/Objects/typeobject.c
@@ -4854,16 +4854,7 @@ slot_tp_call(PyObject *self, PyObject *args, PyObject *kwds)
        if (meth == NULL)
                return NULL;
 
-       /* PyObject_Call() will end up calling slot_tp_call() again if
-          the object returned for __call__ has __call__ itself defined
-          upon it.  This can be an infinite recursion if you set
-          __call__ in a class to an instance of it. */
-       if (Py_EnterRecursiveCall(" in __call__")) {
-               Py_DECREF(meth);
-               return NULL;
-       }
        res = PyObject_Call(meth, args, kwds);
-       Py_LeaveRecursiveCall();
 
        Py_DECREF(meth);
        return res;

diff --git a/Python/errors.c b/Python/errors.c
index 3b8ea64f67398d6121699b9782de38a213d40751..63acf3306654581d53f1decb95c8c3edead1c5b2 100644 (file)
--- a/Python/errors.c
+++ b/Python/errors.c
@@ -132,6 +132,7 @@ PyErr_NormalizeException(PyObject **exc, PyObject **val, PyObject **tb)
        PyObject *value = *val;
        PyObject *inclass = NULL;
        PyObject *initial_tb = NULL;
+       PyThreadState *tstate = NULL;
 
        if (type == NULL) {
                /* There was no exception, so nothing to do. */
@@ -207,7 +208,14 @@ finally:
                        Py_DECREF(initial_tb);
        }
        /* normalize recursively */
+       tstate = PyThreadState_GET();
+       if (++tstate->recursion_depth > Py_GetRecursionLimit()) {
+           --tstate->recursion_depth;
+           PyErr_SetObject(PyExc_RuntimeError, PyExc_RecursionErrorInst);
+           return;
+       }
        PyErr_NormalizeException(exc, val, tb);
+       --tstate->recursion_depth;
 }