Skip to content

gh-155452: Prevent recursion crash in dir() - #155453

Open
BHUVANSH855 wants to merge 2 commits into
python:mainfrom
BHUVANSH855:investigate-0071-dir-cyclic-bases
Open

gh-155452: Prevent recursion crash in dir()#155453
BHUVANSH855 wants to merge 2 commits into
python:mainfrom
BHUVANSH855:investigate-0071-dir-cyclic-bases

Conversation

@BHUVANSH855

Copy link
Copy Markdown
Contributor

gh-155452: Prevent recursion crash in dir() when __bases__ is cyclic.

Summary

dir() could cause a native stack overflow when an object's __class__
provided a cyclic __bases__ attribute.

merge_class_dict() recursively traverses __bases__ without a recursion
guard. This change protects that recursion with _Py_EnterRecursiveCall()
and _Py_LeaveRecursiveCall(), matching the existing protection in
abstract_issubclass().

Changes

  • Add the required pycore_ceval.h include.
  • Guard recursive __bases__ traversal in merge_class_dict().
  • Add a regression test using a one-node cyclic __bases__ graph.
  • Add a NEWS entry.

Testing

Before the fix, the reproducer resulted in:

Segmentation fault
rc=139

After the fix, it raises:

RecursionError: Stack overflow (used 8120 kB) in __bases__

Targeted regression test:

./python -m test test_builtin -m test_dir
== Tests result: SUCCESS ==
1 test OK.

Closes issue gh-155452

@skirpichev skirpichev left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Apparently, this fails on WASI/emscripten.

I think you should create a separate test and filter it out with skip_wasi_stack_overflow/skip_emscripten_stack_overflow decorators.

Comment thread Objects/typeobject.c
Py_DECREF(bases);
return -1;
}
else {

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You can reduce patch, leaving "else" branch. Just add _Py_EnterRecursiveCall/_Py_LeaveRecursiveCall calls.

@ZeroIntensity ZeroIntensity left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am extremely opposed to accepting changes of this nature; see #155102 (comment) and #155452 (comment).

@bedevere-app

bedevere-app Bot commented Aug 10, 2026

Copy link
Copy Markdown

A Python core developer has requested some changes be made to your pull request before we can consider merging it. If you could please address their requests along with any other requests in other reviews from core developers that would be appreciated.

Once you have made the requested changes, please leave a comment on this pull request containing the phrase I have made the requested changes; please review again. I will then notify any core developers who have left a review that you're ready for them to take another look at this pull request.

@picnixz

picnixz commented Aug 10, 2026

Copy link
Copy Markdown
Member

For this one, I'm not opposed.

Comment thread Lib/test/test_builtin.py Outdated
@skirpichev
skirpichev removed their request for review August 10, 2026 09:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants