changeset:   101926:e44bd1259bda
branch:      3.5
parent:      101924:34d24c51eab6
user:        Serhiy Storchaka <storchaka@gmail.com>
date:        Sun Jun 12 09:43:55 2016 +0300
files:       Lib/test/test_xml_etree.py Misc/NEWS Modules/_elementtree.c
description:
Issue #25455: Fixed a crash in repr of ElementTree.Element with recursive tag.


diff -r 34d24c51eab6 -r e44bd1259bda Lib/test/test_xml_etree.py
--- a/Lib/test/test_xml_etree.py	Sun Jun 12 09:22:01 2016 +0300
+++ b/Lib/test/test_xml_etree.py	Sun Jun 12 09:43:55 2016 +0300
@@ -18,7 +18,7 @@
 
 from itertools import product
 from test import support
-from test.support import TESTFN, findfile, import_fresh_module, gc_collect
+from test.support import TESTFN, findfile, import_fresh_module, gc_collect, swap_attr
 
 # pyET is the pure-Python implementation.
 #
@@ -1860,6 +1860,12 @@
         e.extend([ET.Element('bar')])
         self.assertRaises(ValueError, e.remove, X('baz'))
 
+    def test_recursive_repr(self):
+        # Issue #25455
+        e = ET.Element('foo')
+        with swap_attr(e, 'tag', e):
+            with self.assertRaises(RuntimeError):
+                repr(e)  # Should not crash
 
 class MutatingElementPath(str):
     def __new__(cls, elem, *args):
diff -r 34d24c51eab6 -r e44bd1259bda Misc/NEWS
--- a/Misc/NEWS	Sun Jun 12 09:22:01 2016 +0300
+++ b/Misc/NEWS	Sun Jun 12 09:43:55 2016 +0300
@@ -143,6 +143,8 @@
 Library
 -------
 
+- Issue #25455: Fixed a crash in repr of ElementTree.Element with recursive tag.
+
 - Issue #26556: Update expat to 2.1.1, fixes CVE-2015-1283.
 
 - Fix TLS stripping vulnerability in smptlib, CVE-2016-0772.  Reported by Team
diff -r 34d24c51eab6 -r e44bd1259bda Modules/_elementtree.c
--- a/Modules/_elementtree.c	Sun Jun 12 09:22:01 2016 +0300
+++ b/Modules/_elementtree.c	Sun Jun 12 09:43:55 2016 +0300
@@ -1582,10 +1582,23 @@
 static PyObject*
 element_repr(ElementObject* self)
 {
-    if (self->tag)
-        return PyUnicode_FromFormat("<Element %R at %p>", self->tag, self);
-    else
+    int status;
+
+    if (self->tag == NULL)
         return PyUnicode_FromFormat("<Element at %p>", self);
+
+    status = Py_ReprEnter((PyObject *)self);
+    if (status == 0) {
+        PyObject *res;
+        res = PyUnicode_FromFormat("<Element %R at %p>", self->tag, self);
+        Py_ReprLeave((PyObject *)self);
+        return res;
+    }
+    if (status > 0)
+        PyErr_Format(PyExc_RuntimeError,
+                     "reentrant call inside %s.__repr__",
+                     Py_TYPE(self)->tp_name);
+    return NULL;
 }
 
 /*[clinic input]