From 8357734dd72ebd1e9958e6b20a5efb283a5808cf Mon Sep 17 00:00:00 2001
From: Dennis Sweeney <36520290+sweeneyde@users.noreply.github.com>
Date: Fri, 22 Oct 2021 17:24:08 -0400
Subject: [PATCH] bpo-30570: Use Py_EnterRecursiveCall() in issubclass()
 (GH-29048)

* Use Py_EnterRecursiveCall() in issubclass()

Reviewed-by: Gregory P. Smith <greg@krypto.org> [Google]
(cherry picked from commit 423fa1c1817abfa8c3d1bc308ddbbd8f28b69d68)

Co-authored-by: Dennis Sweeney <36520290+sweeneyde@users.noreply.github.com>
---
 Lib/test/test_isinstance.py                   | 30 +++++++++++++++++++
 .../2021-10-19-01-04-08.bpo-30570._G30Ms.rst  |  1 +
 Objects/abstract.c                            | 20 +++++++++----
 3 files changed, 45 insertions(+), 6 deletions(-)
 create mode 100644 Misc/NEWS.d/next/Core and Builtins/2021-10-19-01-04-08.bpo-30570._G30Ms.rst

diff --git a/Lib/test/test_isinstance.py b/Lib/test/test_isinstance.py
index 109c3f84a5c426..6ab44be9a26ba7 100644
--- a/Lib/test/test_isinstance.py
+++ b/Lib/test/test_isinstance.py
@@ -313,6 +313,36 @@ def __bases__(self):
         self.assertRaises(RecursionError, issubclass, int, X())
         self.assertRaises(RecursionError, isinstance, 1, X())
 
+    def test_infinite_recursion_via_bases_tuple(self):
+        """Regression test for bpo-30570."""
+        class Failure(object):
+            def __getattr__(self, attr):
+                return (self, None)
+
+        with self.assertRaises(RecursionError):
+            issubclass(Failure(), int)
+
+    def test_infinite_cycle_in_bases(self):
+        """Regression test for bpo-30570."""
+        class X:
+            @property
+            def __bases__(self):
+                return (self, self, self)
+        self.assertRaises(RecursionError, issubclass, X(), int)
+
+    def test_infinitely_many_bases(self):
+        """Regression test for bpo-30570."""
+        class X:
+            def __getattr__(self, attr):
+                self.assertEqual(attr, "__bases__")
+                class A:
+                    pass
+                class B:
+                    pass
+                A.__getattr__ = B.__getattr__ = X.__getattr__
+                return (A(), B())
+        self.assertRaises(RecursionError, issubclass, X(), int)
+
 
 def blowstack(fxn, arg, compare_to):
     # Make sure that calling isinstance with a deeply nested tuple for its
diff --git a/Misc/NEWS.d/next/Core and Builtins/2021-10-19-01-04-08.bpo-30570._G30Ms.rst b/Misc/NEWS.d/next/Core and Builtins/2021-10-19-01-04-08.bpo-30570._G30Ms.rst
new file mode 100644
index 00000000000000..d9ab60cd08f56d
--- /dev/null
+++ b/Misc/NEWS.d/next/Core and Builtins/2021-10-19-01-04-08.bpo-30570._G30Ms.rst	
@@ -0,0 +1 @@
+Fixed a crash in ``issubclass()`` from infinite recursion when searching pathological ``__bases__`` tuples.
\ No newline at end of file
diff --git a/Objects/abstract.c b/Objects/abstract.c
index c056c6698850c9..3ac85544defbdd 100644
--- a/Objects/abstract.c
+++ b/Objects/abstract.c
@@ -2557,14 +2557,22 @@ abstract_issubclass(PyObject *derived, PyObject *cls)
             derived = PyTuple_GET_ITEM(bases, 0);
             continue;
         }
-        for (i = 0; i < n; i++) {
-            r = abstract_issubclass(PyTuple_GET_ITEM(bases, i), cls);
-            if (r != 0)
-                break;
-        }
+        break;
+    }
+    assert(n >= 2);
+    if (Py_EnterRecursiveCall(" in __issubclass__")) {
         Py_DECREF(bases);
-        return r;
+        return -1;
     }
+    for (i = 0; i < n; i++) {
+        r = abstract_issubclass(PyTuple_GET_ITEM(bases, i), cls);
+        if (r != 0) {
+            break;
+        }
+    }
+    Py_LeaveRecursiveCall();
+    Py_DECREF(bases);
+    return r;
 }
 
 static int