From 5afa03a72ee6d27e742dc0ebc06a0630e1b37fe9 Mon Sep 17 00:00:00 2001
From: Benjamin Peterson <benjamin@python.org>
Date: Fri, 15 Jul 2011 14:09:26 -0500
Subject: catch nasty exception classes with __new__ that doesn't return a
 exception (closes #11627)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Patch from Andreas Stührk.
---
 Lib/test/test_raise.py | 9 +++++++++
 Misc/NEWS              | 3 +++
 Python/ceval.c         | 7 +++++++
 3 files changed, 19 insertions(+)

diff --git a/Lib/test/test_raise.py b/Lib/test/test_raise.py
index d120dc1..e02c1af 100644
--- a/Lib/test/test_raise.py
+++ b/Lib/test/test_raise.py
@@ -121,6 +121,15 @@ class TestRaise(unittest.TestCase):
         else:
             self.fail("No exception raised")
 
+    def test_new_returns_invalid_instance(self):
+        # See issue #11627.
+        class MyException(Exception):
+            def __new__(cls, *args):
+                return object()
+
+        with self.assertRaises(TypeError):
+            raise MyException
+
 
 class TestCause(unittest.TestCase):
     def test_invalid_cause(self):
diff --git a/Misc/NEWS b/Misc/NEWS
index 18ee9d3..cba337a 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -10,6 +10,9 @@ What's New in Python 3.2.2?
 Core and Builtins
 -----------------
 
+- Issue #11627: Fix segfault when __new__ on a exception returns a non-exception
+  class.
+
 - Issue #12149: Update the method cache after a type's dictionnary gets
   cleared by the garbage collector.  This fixes a segfault when an instance
   and its type get caught in a reference cycle, and the instance's
diff --git a/Python/ceval.c b/Python/ceval.c
index 5c3bb83..f0ea7c9 100644
--- a/Python/ceval.c
+++ b/Python/ceval.c
@@ -3413,6 +3413,13 @@ do_raise(PyObject *exc, PyObject *cause)
         value = PyObject_CallObject(exc, NULL);
         if (value == NULL)
             goto raise_error;
+        if (!PyExceptionInstance_Check(value)) {
+            PyErr_Format(PyExc_TypeError,
+                         "calling %R should have returned an instance of "
+                         "BaseException, not %R",
+                         type, Py_TYPE(value));
+            goto raise_error;
+        }
     }
     else if (PyExceptionInstance_Check(exc)) {
         value = exc;
-- 
cgit v0.12