From 305f8bce360d3756b29e405dd520b42730fa2856 Mon Sep 17 00:00:00 2001 From: Serhiy Storchaka Date: Mon, 5 Oct 2020 00:55:57 +0300 Subject: [PATCH] [3.9] bpo-41909: Enable previously disabled recursion checks. (GH-22536) Enable recursion checks which were disabled when get __bases__ of non-type objects in issubclass() and isinstance() and when intern strings. It fixes a stack overflow when getting __bases__ leads to infinite recursion. Originally recursion checks was disabled for PyDict_GetItem() which silences all errors including the one raised in case of detected recursion and can return incorrect result. But now the code uses PyDict_GetItemWithError() and PyDict_SetDefault() instead. (cherry picked from commit 9ece9cd65cdeb0a1f6e60475bbd0219161c348ac) Co-authored-by: Serhiy Storchaka --- Lib/test/test_isinstance.py | 10 ++++++++++ .../2020-10-04-10-55-12.bpo-41909.BqHPcm.rst | 2 ++ Objects/abstract.c | 2 -- Objects/unicodeobject.c | 2 -- 4 files changed, 12 insertions(+), 4 deletions(-) create mode 100644 Misc/NEWS.d/next/Core and Builtins/2020-10-04-10-55-12.bpo-41909.BqHPcm.rst diff --git a/Lib/test/test_isinstance.py b/Lib/test/test_isinstance.py index 53639e984e48a7..31b38996930cc4 100644 --- a/Lib/test/test_isinstance.py +++ b/Lib/test/test_isinstance.py @@ -271,6 +271,16 @@ def __bases__(self): self.assertEqual(True, issubclass(B(), int)) + def test_infinite_recursion_in_bases(self): + class X: + @property + def __bases__(self): + return self.__bases__ + + self.assertRaises(RecursionError, issubclass, X(), int) + self.assertRaises(RecursionError, issubclass, int, X()) + self.assertRaises(RecursionError, isinstance, 1, X()) + def blowstack(fxn, arg, compare_to): # Make sure that calling isinstance with a deeply nested tuple for its diff --git a/Misc/NEWS.d/next/Core and Builtins/2020-10-04-10-55-12.bpo-41909.BqHPcm.rst b/Misc/NEWS.d/next/Core and Builtins/2020-10-04-10-55-12.bpo-41909.BqHPcm.rst new file mode 100644 index 00000000000000..388cfea065eedc --- /dev/null +++ b/Misc/NEWS.d/next/Core and Builtins/2020-10-04-10-55-12.bpo-41909.BqHPcm.rst @@ -0,0 +1,2 @@ +Fixed stack overflow in :func:`issubclass` and :func:`isinstance` when +getting the ``__bases__`` attribute leads to infinite recursion. diff --git a/Objects/abstract.c b/Objects/abstract.c index 1d671c9e3334a5..1922619ad85db0 100644 --- a/Objects/abstract.c +++ b/Objects/abstract.c @@ -2375,9 +2375,7 @@ abstract_get_bases(PyObject *cls) _Py_IDENTIFIER(__bases__); PyObject *bases; - Py_ALLOW_RECURSION (void)_PyObject_LookupAttrId(cls, &PyId___bases__, &bases); - Py_END_ALLOW_RECURSION if (bases != NULL && !PyTuple_Check(bases)) { Py_DECREF(bases); return NULL; diff --git a/Objects/unicodeobject.c b/Objects/unicodeobject.c index 4c8c880657974f..3c2383d57c863e 100644 --- a/Objects/unicodeobject.c +++ b/Objects/unicodeobject.c @@ -15602,9 +15602,7 @@ PyUnicode_InternInPlace(PyObject **p) } PyObject *t; - Py_ALLOW_RECURSION t = PyDict_SetDefault(interned, s, s); - Py_END_ALLOW_RECURSION if (t == NULL) { PyErr_Clear();