gh-156204: Guard recursion in PyErr_GivenExceptionMatches

[BHUVANSH855]

Fixes issue gh-156204.

PyErr_GivenExceptionMatches in Python/errors.c recursively unpacks tuple targets without recursion checks, causing native C stack exhaustion and a SIGSEGV when given deeply nested exception tuples.

This change:

• Guards recursion in PyErr_GivenExceptionMatches via Py_EnterRecursiveCall() and Py_LeaveRecursiveCall().
• Adds a _testcapi.err_givenexceptionmatches() helper and a regression test in Lib/test/test_exceptions.py.
• Adds a blurb NEWS entry.

Verified: with Python/errors.c reverted to the pre-fix version the new test segfaults; with the fix it passes.

[read-the-docs-community]

Documentation build overview

📚 cpython-previews | 🛠️ Build #34178190 | 📁 Comparing b6be6c5 against main (999a046)

  🔍 Preview build  

2 files changed

± c-api/exceptions.html
± whatsnew/changelog.html

[iritkatriel]

Looks like some test is failing.

[BHUVANSH855]

Looks like some test is failing.

hi, the failing checks were unrelated to this PR, as the PR was stale form some days, so I updated the branch and synced it to the current main.
Hope this time no check fails.

[ZeroIntensity]

LGTM. I'll give Irit some time to take another look before merging, and I'll also run the buildbots in the meantime to make sure that the recursive test doesn't fail on some weird platforms.

[bedevere-bot]

🤖 New build scheduled with the buildbot fleet by @ZeroIntensity for commit 141b181 🤖

Results will be shown at:

https://buildbot.python.org/all/#/grid?branch=refs%2Fpull%2F156205%2Fmerge

If you want to schedule another build, you need to add the 🔨 test-with-buildbots label again.

[miss-islington-app]

Thanks @BHUVANSH855 for the PR, and @ZeroIntensity for merging it 🌮🎉.. I'm working now to backport this PR to: 3.14, 3.15.
🐍🍒⛏🤖

[bedevere-app]

GH-158622 is a backport of this pull request to the 3.15 branch.

[bedevere-app]

GH-158623 is a backport of this pull request to the 3.14 branch.

[bedevere-bot]

⚠️⚠️⚠️ Buildbot failure ⚠️⚠️⚠️

Hi! The buildbot AMD64 Windows Server 2022 NoGIL 3.14 (tier-1) has failed when building commit a9eeb9f.

What do you need to do:

1. Don't panic.
2. Check the buildbot page in the devguide if you don't know what the buildbots are or how they work.
3. Go to the page of the buildbot that failed (https://buildbot.python.org/#/builders/1717/builds/1803) and take a look at the build logs.
4. Check if the failure is related to this commit (a9eeb9f) or if it is a false positive.
5. If the failure is related to this commit, please, reflect that on the issue and make a new Pull Request with a fix.

You can take a look at the buildbot page here:

https://buildbot.python.org/#/builders/1717/builds/1803

Summary of the results of the build (if available):

==

Click to see traceback logs

Note: switching to 'a9eeb9f2f517046fc1fae061dee0e6856a414077'.

You are in 'detached HEAD' state. You can look around, make experimental
changes and commit them, and you can discard any commits you make in this
state without impacting any branches by switching back to a branch.

If you want to create a new branch to retain commits you create, you may
do so (now or later) by using -c with the switch command. Example:

  git switch -c <new-branch-name>

Or undo this operation with:

  git switch -

Turn off this advice by setting config variable advice.detachedHead to false

HEAD is now at a9eeb9f2f51 [3.14] gh-156204: Guard recursion in `PyErr_GivenExceptionMatches` (GH-156205) (GH-158623)
Switched to and reset branch '3.14'

Could Not Find C:\bbarea\3.14.itamaro-win64-srv-22-aws.x64.nogil\build\Lib\*.pyc
The system cannot find the file specified.
Could Not Find C:\bbarea\3.14.itamaro-win64-srv-22-aws.x64.nogil\build\PCbuild\python*.zip

Kill <WorkerThread #1 running test=test_ssl pid=10028 time=12.7 sec> process
Kill <WorkerThread #2 running test=test_math pid=12212 time=1 min 23 sec> process
Kill <WorkerThread #3 running test=test_platform pid=11020 time=5.1 sec> process
Kill <WorkerThread #4 running test=test_mmap pid=10216 time=50.5 sec> process
Kill <WorkerThread #5 running test=test_generated_cases pid=4316 time=1.9 sec> process
Kill <WorkerThread #6 running test=test_tarfile pid=2016 time=1 min 19 sec> process
Kill <WorkerThread #7 running test=test.test_multiprocessing_spawn.test_processes pid=8764 time=1 min 35 sec> process
Kill <WorkerThread #8 running test=test_linecache pid=16160 time=2.1 sec> process
Kill <WorkerThread #9 running test=test_complex pid=11812 time=746 ms> process
Kill <WorkerThread #10 running test=test_sys pid=1820 time=3.9 sec> process
Kill <WorkerThread #11 running test=test_statistics pid=12164 time=1 min 33 sec> process
Kill <WorkerThread #12 running test=test_traceback pid=10472 time=45.0 sec> process
Kill <WorkerThread #13 running test=test_lzma pid=3568 time=3.6 sec> process
Kill <WorkerThread #14 running test=test_dataclasses pid=3984 time=1.8 sec> process
Kill <WorkerThread #15 running test=test_json pid=12988 time=33.7 sec> process
Kill <WorkerThread #16 running test=test_weakref pid=11724 time=13.4 sec> process
Kill <WorkerThread #18 running test=test_frame pid=17040 time=1.5 sec> process
Kill <WorkerThread #19 running test=test_free_threading pid=8940 time=1 min 35 sec> process
Kill <WorkerThread #20 running test=test_compileall pid=6524 time=46.6 sec> process

Could Not Find C:\bbarea\3.14.itamaro-win64-srv-22-aws.x64.nogil\build\PCbuild\python*.zip

Expanding reachable commits in commit graph: 138558
Expanding reachable commits in commit graph: 171624, done.