An object with __call__ as an attribute, when called, will have that attribute checked for __call__ itself, and will continue to look until it finds an object without the attribute. This can lead to an infinite recursion.

Closes bug #532646, again.  Will be backported.

4 files changed, 30 insertions, 9 deletions

diff --git a/Lib/test/crashers/infinite_rec_3.py b/Lib/test/crashers/infinite_rec_3.py
deleted file mode 100644
index 0b04e4c..0000000
--- a/Lib/test/crashers/infinite_rec_3.py
+++ /dev/null
@@ -1,9 +0,0 @@
-
-# http://python.org/sf/1202533
-
-class A(object):
-    pass
-A.__call__ = A()
-
-if __name__ == '__main__':
-    A()()   # segfault: infinite recursion in C
diff --git a/Lib/test/test_descr.py b/Lib/test/test_descr.py
index ca91042..d9249b6 100644
--- a/Lib/test/test_descr.py
+++ b/Lib/test/test_descr.py
@@ -3171,6 +3171,21 @@ def kwdargs():
     list.__init__(a, sequence=[0, 1, 2])
     vereq(a, [0, 1, 2])
 
+def recursive__call__():
+    if verbose: print ("Testing recursive __call__() by setting to instance of "
+                        "class ...")
+    class A(object):
+        pass
+
+    A.__call__ = A()
+    try:
+        A()()
+    except RuntimeError:
+        pass
+    else:
+        raise TestFailed("Recursion limit should have been reached for "
+                         "__call__()")
+
 def delhook():
     if verbose: print "Testing __del__ hook..."
     log = []
@@ -4164,6 +4179,7 @@ def test_main():
     buffer_inherit()
     str_of_str_subclass()
     kwdargs()
+    recursive__call__()
     delhook()
     hashinherit()
     strops()
diff --git a/Misc/NEWS b/Misc/NEWS
index 3bd732e..3ec43af 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -12,6 +12,12 @@ What's New in Python 2.5 beta 1?
 Core and builtins
 -----------------
 
+- Bug #532646: object.__call__() will continue looking for the __call__
+  attribute on objects until one without one is found.  This leads to recursion
+  when you take a class and set its __call__ attribute to an instance of the
+  class.  Originally fixed for classic classes, but this fix is for new-style.
+  Removes the infinite_rec_3 crasher.
+
 - The string and unicode methods startswith() and endswith() now accept
   a tuple of prefixes/suffixes to look for. Implements RFE #1491485.
 
diff --git a/Objects/abstract.c b/Objects/abstract.c
index 83c48c2..53898c5 100644
--- a/Objects/abstract.c
+++ b/Objects/abstract.c
@@ -1790,7 +1790,15 @@ PyObject_Call(PyObject *func, PyObject *arg, PyObject *kw)
         ternaryfunc call;
 
 	if ((call = func->ob_type->tp_call) != NULL) {
+		/* slot_tp_call() will be called and ends up calling
+		   PyObject_Call() if the object returned for __call__ has
+		   __call__ itself defined upon it.  This can be an infinite
+		   recursion if you set __call__ in a class to an instance of
+		   it. */
+		if (Py_EnterRecursiveCall(" in __call__"))
+		    return NULL;
 		PyObject *result = (*call)(func, arg, kw);
+		Py_LeaveRecursiveCall();
 		if (result == NULL && !PyErr_Occurred())
 			PyErr_SetString(
 				PyExc_SystemError,