Fix a possible segfault from recursing too deep to get the repr of a list.

Closes issue #1096.

diff --git a/Lib/test/list_tests.py b/Lib/test/list_tests.py
index 1c799d760ea997f08a683c3070faa1fce338687e..a0011a46fbf02a64cb733f569142ffd5a0cc8ace 100644 (file)
--- a/Lib/test/list_tests.py
+++ b/Lib/test/list_tests.py
@@ -46,6 +46,11 @@ class CommonTest(seq_tests.CommonTest):
         self.assertEqual(str(a2), "[0, 1, 2, [...], 3]")
         self.assertEqual(repr(a2), "[0, 1, 2, [...], 3]")
 
+        l0 = []
+        for i in xrange(sys.getrecursionlimit() + 100):
+            l0 = [l0]
+        self.assertRaises(RuntimeError, repr, l0)
+
     def test_print(self):
         d = self.type2test(xrange(200))
         d.append(d)

diff --git a/Misc/NEWS b/Misc/NEWS
index 99e4f07131efe75761e74f7976f094cf513e3601..10f2c71e7ccf8eb180652a7d31901d478c45d589 100644 (file)
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -12,6 +12,9 @@ What's New in Python 2.6 alpha 1?
 Core and builtins
 -----------------
 
+- Issue #1096: Prevent a segfault from getting the repr of a very deeply nested
+  list by using the recursion counter.
+
 - Issue #1202533: Fix infinite recursion calls triggered by calls to
   PyObject_Call() never calling back out to Python code to trigger recursion
   depth updates/checks.  Required the creation of a static RuntimeError

diff --git a/Objects/listobject.c b/Objects/listobject.c
index c0621dce914a0458d91c5b212fee26cdce55a5ea..92bad8c7c84afb80967c6abf61e7a37efa61f1e6 100644 (file)
--- a/Objects/listobject.c
+++ b/Objects/listobject.c
@@ -324,7 +324,10 @@ list_repr(PyListObject *v)
           so must refetch the list size on each iteration. */
        for (i = 0; i < Py_Size(v); ++i) {
                int status;
+               if (Py_EnterRecursiveCall(" while getting the repr of a list"))
+                       goto Done;
                s = PyObject_Repr(v->ob_item[i]);
+               Py_LeaveRecursiveCall();
                if (s == NULL)
                        goto Done;
                status = PyList_Append(pieces, s);