From af56e0e70f043ad2615eff403f46d7bc6c411aae Mon Sep 17 00:00:00 2001
From: Raymond Hettinger <python@rcn.com>
Date: Fri, 16 Dec 2016 13:57:40 -0800
Subject: Issue #28991:  Fix obscure reentrancy bug in functools.lru_cache().

---
 Lib/functools.py           |  6 ++++--
 Lib/test/test_functools.py | 13 +++++++++++++
 Misc/NEWS                  |  3 +++
 3 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/Lib/functools.py b/Lib/functools.py
index 214523c..60cf3c4 100644
--- a/Lib/functools.py
+++ b/Lib/functools.py
@@ -516,14 +516,16 @@ def _lru_cache_wrapper(user_function, maxsize, typed, _CacheInfo):
                     last = root[PREV]
                     link = [last, root, key, result]
                     last[NEXT] = root[PREV] = cache[key] = link
-                    full = (len(cache) >= maxsize)
+                    # Use the __len__() method instead of the len() function
+                    # which could potentially be wrapped in an lru_cache itself.
+                    full = (cache.__len__() >= maxsize)
                 misses += 1
             return result
 
     def cache_info():
         """Report cache statistics"""
         with lock:
-            return _CacheInfo(hits, misses, maxsize, len(cache))
+            return _CacheInfo(hits, misses, maxsize, cache.__len__())
 
     def cache_clear():
         """Clear the cache and cache statistics"""
diff --git a/Lib/test/test_functools.py b/Lib/test/test_functools.py
index 6a3bf64..b431e05 100644
--- a/Lib/test/test_functools.py
+++ b/Lib/test/test_functools.py
@@ -1,4 +1,5 @@
 import abc
+import builtins
 import collections
 import copy
 from itertools import permutations
@@ -1162,6 +1163,18 @@ class TestLRU:
         self.assertEqual(misses, 4)
         self.assertEqual(currsize, 2)
 
+    def test_lru_reentrancy_with_len(self):
+        # Test to make sure the LRU cache code isn't thrown-off by
+        # caching the built-in len() function.  Since len() can be
+        # cached, we shouldn't use it inside the lru code itself.
+        old_len = builtins.len
+        try:
+            builtins.len = self.module.lru_cache(4)(len)
+            for i in [0, 0, 1, 2, 3, 3, 4, 5, 6, 1, 7, 2, 1]:
+                self.assertEqual(len('abcdefghijklmn'[:i]), i)
+        finally:
+            builtins.len = old_len
+
     def test_lru_type_error(self):
         # Regression test for issue #28653.
         # lru_cache was leaking when one of the arguments
diff --git a/Misc/NEWS b/Misc/NEWS
index 806a603..073a9f7 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -13,6 +13,9 @@ Core and Builtins
 - Issue #28512: Fixed setting the offset attribute of SyntaxError by
   PyErr_SyntaxLocationEx() and PyErr_SyntaxLocationObject().
 
+- Issue #28991:  functools.lru_cache() was susceptible to an obscure reentrancy
+  bug caused by a monkey-patched len() function.
+
 - Issue #28648: Fixed crash in Py_DecodeLocale() in debug build on Mac OS X
   when decode astral characters.  Patch by Xiang Zhang.
 
-- 
cgit v0.12