[Python-checkins] cpython (3.5): Issue #25455: Fixed a crash in repr of ElementTree.Element with recursive tag.

Sun Jun 12 02:49:46 EDT 2016

https://hg.python.org/cpython/rev/e44bd1259bda
changeset: 101926:e44bd1259bda
branch: 3.5
parent: 101924:34d24c51eab6
user: Serhiy Storchaka <storchaka at gmail.com>
date: Sun Jun 12 09:43:55 2016 +0300
summary:
 Issue #25455: Fixed a crash in repr of ElementTree.Element with recursive tag.
files:
 Lib/test/test_xml_etree.py | 8 +++++++-
 Misc/NEWS | 2 ++
 Modules/_elementtree.c | 19 ++++++++++++++++---
 3 files changed, 25 insertions(+), 4 deletions(-)

diff --git a/Lib/test/test_xml_etree.py b/Lib/test/test_xml_etree.py
--- a/Lib/test/test_xml_etree.py
+++ b/Lib/test/test_xml_etree.py
@@ -18,7 +18,7 @@
 
 from itertools import product
 from test import support
-from test.support import TESTFN, findfile, import_fresh_module, gc_collect
+from test.support import TESTFN, findfile, import_fresh_module, gc_collect, swap_attr
 
 # pyET is the pure-Python implementation.
 #
@@ -1860,6 +1860,12 @@
 e.extend([ET.Element('bar')])
 self.assertRaises(ValueError, e.remove, X('baz'))
 
+ def test_recursive_repr(self):
+ # Issue #25455
+ e = ET.Element('foo')
+ with swap_attr(e, 'tag', e):
+ with self.assertRaises(RuntimeError):
+ repr(e) # Should not crash
 
 class MutatingElementPath(str):
 def __new__(cls, elem, *args):
diff --git a/Misc/NEWS b/Misc/NEWS
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -143,6 +143,8 @@
 Library
 -------
 
+- Issue #25455: Fixed a crash in repr of ElementTree.Element with recursive tag.
+
 - Issue #26556: Update expat to 2.1.1, fixes CVE-2015-1283.
 
 - Fix TLS stripping vulnerability in smptlib, CVE-2016-0772. Reported by Team
diff --git a/Modules/_elementtree.c b/Modules/_elementtree.c
--- a/Modules/_elementtree.c
+++ b/Modules/_elementtree.c
@@ -1582,10 +1582,23 @@
 static PyObject*
 element_repr(ElementObject* self)
 {
- if (self->tag)
- return PyUnicode_FromFormat("<Element %R at %p>", self->tag, self);
- else
+ int status;
+
+ if (self->tag == NULL)
 return PyUnicode_FromFormat("<Element at %p>", self);
+
+ status = Py_ReprEnter((PyObject *)self);
+ if (status == 0) {
+ PyObject *res;
+ res = PyUnicode_FromFormat("<Element %R at %p>", self->tag, self);
+ Py_ReprLeave((PyObject *)self);
+ return res;
+ }
+ if (status > 0)
+ PyErr_Format(PyExc_RuntimeError,
+ "reentrant call inside %s.__repr__",
+ Py_TYPE(self)->tp_name);
+ return NULL;
 }
 
 /*[clinic input]
-- 
Repository URL: https://hg.python.org/cpython
