From 9b0b7266954e7550d6e1b236e6f0fc83e11f7d48 Mon Sep 17 00:00:00 2001 From: Bhuvansh Kataria Date: Sun, 9 Aug 2026 21:28:47 +0000 Subject: [PATCH 1/2] gh-155452: Prevent recursion crash in dir() --- Lib/test/test_builtin.py | 14 ++++++++ ...-08-09-21-24-08.gh-issue-155452.4mUzjM.rst | 2 ++ Objects/typeobject.c | 34 +++++++++++-------- 3 files changed, 36 insertions(+), 14 deletions(-) create mode 100644 Misc/NEWS.d/next/Core_and_Builtins/2026-08-09-21-24-08.gh-issue-155452.4mUzjM.rst diff --git a/Lib/test/test_builtin.py b/Lib/test/test_builtin.py index 1d2c105ac047e18..5647593c449f4b7 100644 --- a/Lib/test/test_builtin.py +++ b/Lib/test/test_builtin.py @@ -700,6 +700,20 @@ def __init__(self): f = Foo() self.assertIn("y", dir(f)) + # dir(obj) - cyclic __bases__ must raise RecursionError + class Fake: + pass + + a = Fake() + a.__bases__ = (a,) + + class C: + @property + def __class__(self): + return a + + self.assertRaises(RecursionError, dir, C()) + # dir(obj_no__dict__) class Foo(object): __slots__ = [] diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-08-09-21-24-08.gh-issue-155452.4mUzjM.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-08-09-21-24-08.gh-issue-155452.4mUzjM.rst new file mode 100644 index 000000000000000..196e5c2edd51bea --- /dev/null +++ b/Misc/NEWS.d/next/Core_and_Builtins/2026-08-09-21-24-08.gh-issue-155452.4mUzjM.rst @@ -0,0 +1,2 @@ +Fix a crash in :func:`dir` when an object's ``__class__`` has cyclic +``__bases__``. diff --git a/Objects/typeobject.c b/Objects/typeobject.c index e3026397c8673f1..ed3e5a06709841e 100644 --- a/Objects/typeobject.c +++ b/Objects/typeobject.c @@ -3,6 +3,7 @@ #include "Python.h" #include "pycore_abstract.h" // _PySequence_IterSearch() #include "pycore_call.h" // _PyObject_VectorcallTstate() +#include "pycore_ceval.h" // _Py_EnterRecursiveCall() #include "pycore_code.h" // CO_FAST_FREE #include "pycore_descrobject.h" // _PyMember_GetOffset() #include "pycore_dict.h" // _PyDict_KeysSize() @@ -6949,22 +6950,27 @@ merge_class_dict(PyObject *dict, PyObject *aclass) Py_DECREF(bases); return -1; } - else { - for (i = 0; i < n; i++) { - int status; - PyObject *base = PySequence_GetItem(bases, i); - if (base == NULL) { - Py_DECREF(bases); - return -1; - } - status = merge_class_dict(dict, base); - Py_DECREF(base); - if (status < 0) { - Py_DECREF(bases); - return -1; - } + if (_Py_EnterRecursiveCall(" in __bases__")) { + Py_DECREF(bases); + return -1; + } + for (i = 0; i < n; i++) { + int status; + PyObject *base = PySequence_GetItem(bases, i); + if (base == NULL) { + _Py_LeaveRecursiveCall(); + Py_DECREF(bases); + return -1; + } + status = merge_class_dict(dict, base); + Py_DECREF(base); + if (status < 0) { + _Py_LeaveRecursiveCall(); + Py_DECREF(bases); + return -1; } } + _Py_LeaveRecursiveCall(); Py_DECREF(bases); } return 0; From 5308d8ceb089211dc6dc09ba0c100fe335965c95 Mon Sep 17 00:00:00 2001 From: Bhuvansh Kataria Date: Mon, 10 Aug 2026 09:34:06 +0000 Subject: [PATCH 2/2] gh-155452: Skip dir recursion test on limited stacks --- Lib/test/test_builtin.py | 30 ++++++++++++++++-------------- 1 file changed, 16 insertions(+), 14 deletions(-) diff --git a/Lib/test/test_builtin.py b/Lib/test/test_builtin.py index 5647593c449f4b7..c2d62cf59602d2a 100644 --- a/Lib/test/test_builtin.py +++ b/Lib/test/test_builtin.py @@ -700,20 +700,6 @@ def __init__(self): f = Foo() self.assertIn("y", dir(f)) - # dir(obj) - cyclic __bases__ must raise RecursionError - class Fake: - pass - - a = Fake() - a.__bases__ = (a,) - - class C: - @property - def __class__(self): - return a - - self.assertRaises(RecursionError, dir, C()) - # dir(obj_no__dict__) class Foo(object): __slots__ = [] @@ -769,6 +755,22 @@ def __dir__(self): # test that object has a __dir__() self.assertEqual(sorted([].__dir__()), dir([])) + @support.skip_emscripten_stack_overflow() + @support.skip_wasi_stack_overflow() + def test_dir_cyclic_bases(self): + class Fake: + pass + + a = Fake() + a.__bases__ = (a,) + + class C: + @property + def __class__(self): + return a + + self.assertRaises(RecursionError, dir, C()) + def test___ne__(self): self.assertFalse(None.__ne__(None)) self.assertIs(None.__ne__(0), NotImplemented)