tuple.__repr__ did not consider a reference loop as it is not possible from

Python code; but it is possible from C.  object.__str__ had the issue of not
expecting a type to doing something within it's tp_str implementation that
could trigger an infinite recursion, but it could in C code..  Both found
thanks to BaseException and how it handles its repr.

Closes issue #1686386.  Thanks to Thomas Herve for taking an initial stab at
coming up with a solution.

2 files changed, 18 insertions, 0 deletions

diff --git a/Objects/object.c b/Objects/object.c
index 0651d6b6..e75a03d 100644
--- a/Objects/object.c
+++ b/Objects/object.c
@@ -408,7 +408,12 @@ _PyObject_Str(PyObject *v)
 	if (Py_Type(v)->tp_str == NULL)
 		return PyObject_Repr(v);
 
+	/* It is possible for a type to have a tp_str representation that loops
+	   infinitely. */
+	if (Py_EnterRecursiveCall(" while getting the str of an object"))
+		return NULL;
 	res = (*Py_Type(v)->tp_str)(v);
+	Py_LeaveRecursiveCall();
 	if (res == NULL)
 		return NULL;
 	type_ok = PyString_Check(res);
diff --git a/Objects/tupleobject.c b/Objects/tupleobject.c
index b85762a..38304dd 100644
--- a/Objects/tupleobject.c
+++ b/Objects/tupleobject.c
@@ -216,6 +216,15 @@ tuplerepr(PyTupleObject *v)
 	PyObject *s, *temp;
 	PyObject *pieces, *result = NULL;
 
+	/* While not mutable, it is still possible to end up with a cycle in a
+	   tuple through an object that stores itself within a tuple (and thus
+	   infinitely asks for the repr of itself). This should only be
+	   possible within a type. */
+	i = Py_ReprEnter((PyObject *)v);
+	if (i != 0) {
+		return i > 0 ? PyString_FromString("(...)") : NULL;
+	}
+
 	n = Py_Size(v);
 	if (n == 0)
 		return PyString_FromString("()");
@@ -226,7 +235,10 @@ tuplerepr(PyTupleObject *v)
 
 	/* Do repr() on each element. */
 	for (i = 0; i < n; ++i) {
+		if (Py_EnterRecursiveCall(" while getting the repr of a tuple"))
+			goto Done;
 		s = PyObject_Repr(v->ob_item[i]);
+		Py_LeaveRecursiveCall();
 		if (s == NULL)
 			goto Done;
 		PyTuple_SET_ITEM(pieces, i, s);
@@ -261,6 +273,7 @@ tuplerepr(PyTupleObject *v)
 
 Done:
 	Py_DECREF(pieces);
+	Py_ReprLeave((PyObject *)v);
 	return result;
 }