wrap_cmpfunc(): added a safety check for the __cmp__ wrapper. We can

only safely call a type's tp_compare slot if the second argument is
also an instance of the same type.  I hate to think what
e.g. int_compare() would do with a second argument that's a float!

1 files changed, 9 insertions, 0 deletions

diff --git a/Objects/typeobject.c b/Objects/typeobject.c
index 6200a83..792a9f3 100644
--- a/Objects/typeobject.c
+++ b/Objects/typeobject.c
@@ -2033,6 +2033,15 @@ wrap_cmpfunc(PyObject *self, PyObject *args, void *wrapped)
 
 	if (!PyArg_ParseTuple(args, "O", &other))
 		return NULL;
+	if (!PyType_IsSubtype(other->ob_type, self->ob_type)) {
+		PyErr_Format(
+			PyExc_TypeError,
+			"%s.__cmp__(x,y) requires y to be a '%s', not a '%s'",
+			self->ob_type->tp_name,
+			self->ob_type->tp_name,
+			other->ob_type->tp_name);
+		return NULL;
+	}
 	res = (*func)(self, other);
 	if (PyErr_Occurred())
 		return NULL;