diff -r 09b4850cee9f Lib/test/test_fileio.py --- a/Lib/test/test_fileio.py Sun Jun 12 12:25:43 2016 +0300 +++ b/Lib/test/test_fileio.py Sun Jun 12 15:05:41 2016 +0300 @@ -9,7 +9,8 @@ from array import array from weakref import proxy from functools import wraps -from test.support import TESTFN, check_warnings, run_unittest, make_bad_fd, cpython_only +from test.support import (TESTFN, check_warnings, run_unittest, make_bad_fd, + cpython_only, swap_attr) from collections import UserList import _io # C implementation of io @@ -175,6 +176,12 @@ class AutoFileTests: finally: os.close(fd) + def testRecursiveRepr(self): + # Issue #25455 + with swap_attr(self.f, 'name', self.f): + with self.assertRaises(RuntimeError): + repr(self.f) # Should not crash + def testErrors(self): f = self.f self.assertFalse(f.isatty()) diff -r 09b4850cee9f Lib/test/test_io.py --- a/Lib/test/test_io.py Sun Jun 12 12:25:43 2016 +0300 +++ b/Lib/test/test_io.py Sun Jun 12 15:05:41 2016 +0300 @@ -981,6 +981,16 @@ class CommonBufferedTests: raw.name = b"dummy" self.assertEqual(repr(b), "<%s name=b'dummy'>" % clsname) + def test_recursive_repr(self): + # Issue #25455 + raw = self.MockRawIO() + b = self.tp(raw) + with support.swap_attr(raw, 'name', b): + try: + repr(b) # Should not crash + except RuntimeError: + pass + def test_flush_error_on_close(self): # Test that buffered file is closed despite failed flush # and that flush() is called before file closed. @@ -2391,6 +2401,16 @@ class TextIOWrapperTest(unittest.TestCas t.buffer.detach() repr(t) # Should not raise an exception + def test_recursive_repr(self): + # Issue #25455 + raw = self.BytesIO() + t = self.TextIOWrapper(raw) + with support.swap_attr(raw, 'name', t): + try: + repr(t) # Should not crash + except RuntimeError: + pass + def test_line_buffering(self): r = self.BytesIO() b = self.BufferedWriter(r, 1000) diff -r 09b4850cee9f Misc/NEWS --- a/Misc/NEWS Sun Jun 12 12:25:43 2016 +0300 +++ b/Misc/NEWS Sun Jun 12 15:05:41 2016 +0300 @@ -143,8 +143,8 @@ Core and Builtins Library ------- -- Issue #25455: Fixed crashes in repr of recursive ElementTree.Element and - functools.partial objects. +- Issue #25455: Fixed crashes in repr of recursive ElementTree.Element, + functools.partial, and buffered file-like objects. - Issue #26556: Update expat to 2.1.1, fixes CVE-2015-1283. diff -r 09b4850cee9f Modules/_io/bufferedio.c --- a/Modules/_io/bufferedio.c Sun Jun 12 12:25:43 2016 +0300 +++ b/Modules/_io/bufferedio.c Sun Jun 12 15:05:41 2016 +0300 @@ -1416,8 +1416,18 @@ buffered_repr(buffered *self) res = PyUnicode_FromFormat("<%s>", Py_TYPE(self)->tp_name); } else { - res = PyUnicode_FromFormat("<%s name=%R>", - Py_TYPE(self)->tp_name, nameobj); + int status = Py_ReprEnter((PyObject *)self); + res = NULL; + if (status == 0) { + res = PyUnicode_FromFormat("<%s name=%R>", + Py_TYPE(self)->tp_name, nameobj); + Py_ReprLeave((PyObject *)self); + } + else if (status > 0) { + PyErr_Format(PyExc_RuntimeError, + "reentrant call inside %s.__repr__", + Py_TYPE(self)->tp_name); + } Py_DECREF(nameobj); } return res; diff -r 09b4850cee9f Modules/_io/fileio.c --- a/Modules/_io/fileio.c Sun Jun 12 12:25:43 2016 +0300 +++ b/Modules/_io/fileio.c Sun Jun 12 15:05:41 2016 +0300 @@ -1093,9 +1093,19 @@ fileio_repr(fileio *self) self->fd, mode_string(self), self->closefd ? "True" : "False"); } else { - res = PyUnicode_FromFormat( - "<_io.FileIO name=%R mode='%s' closefd=%s>", - nameobj, mode_string(self), self->closefd ? "True" : "False"); + int status = Py_ReprEnter((PyObject *)self); + res = NULL; + if (status == 0) { + res = PyUnicode_FromFormat( + "<_io.FileIO name=%R mode='%s' closefd=%s>", + nameobj, mode_string(self), self->closefd ? "True" : "False"); + Py_ReprLeave((PyObject *)self); + } + else if (status > 0) { + PyErr_Format(PyExc_RuntimeError, + "reentrant call inside %s.__repr__", + Py_TYPE(self)->tp_name); + } Py_DECREF(nameobj); } return res; diff -r 09b4850cee9f Modules/_io/textio.c --- a/Modules/_io/textio.c Sun Jun 12 12:25:43 2016 +0300 +++ b/Modules/_io/textio.c Sun Jun 12 15:05:41 2016 +0300 @@ -2490,6 +2490,7 @@ static PyObject * textiowrapper_repr(textio *self) { PyObject *nameobj, *modeobj, *res, *s; + int status; CHECK_INITIALIZED(self); @@ -2497,6 +2498,15 @@ textiowrapper_repr(textio *self) if (res == NULL) return NULL; + status = Py_ReprEnter((PyObject *)self); + if (status != 0) { + if (status > 0) { + PyErr_Format(PyExc_RuntimeError, + "reentrant call inside %s.__repr__", + Py_TYPE(self)->tp_name); + } + goto error; + } nameobj = _PyObject_GetAttrId((PyObject *) self, &PyId_name); if (nameobj == NULL) { if (PyErr_ExceptionMatches(PyExc_Exception)) @@ -2511,7 +2521,7 @@ textiowrapper_repr(textio *self) goto error; PyUnicode_AppendAndDel(&res, s); if (res == NULL) - return NULL; + goto error; } modeobj = _PyObject_GetAttrId((PyObject *) self, &PyId_mode); if (modeobj == NULL) { @@ -2527,14 +2537,21 @@ textiowrapper_repr(textio *self) goto error; PyUnicode_AppendAndDel(&res, s); if (res == NULL) - return NULL; + goto error; } s = PyUnicode_FromFormat("%U encoding=%R>", res, self->encoding); Py_DECREF(res); + if (status == 0) { + Py_ReprLeave((PyObject *)self); + } return s; -error: + + error: Py_XDECREF(res); + if (status == 0) { + Py_ReprLeave((PyObject *)self); + } return NULL; }