wrap_cmpfunc(): added a safety check for the __cmp__ wrapper. We can

only safely call a type's tp_compare slot if the second argument is
also an instance of the same type.  I hate to think what
e.g. int_compare() would do with a second argument that's a float!

diff --git a/Objects/typeobject.c b/Objects/typeobject.c
index 6200a830c0aecbeffa837f1f938966512c95e185..792a9f3c286842fdc56329820217197d88ff802e 100644 (file)
--- a/Objects/typeobject.c
+++ b/Objects/typeobject.c
@@ -2033,6 +2033,15 @@ wrap_cmpfunc(PyObject *self, PyObject *args, void *wrapped)
 
        if (!PyArg_ParseTuple(args, "O", &other))
                return NULL;
+       if (!PyType_IsSubtype(other->ob_type, self->ob_type)) {
+               PyErr_Format(
+                       PyExc_TypeError,
+                       "%s.__cmp__(x,y) requires y to be a '%s', not a '%s'",
+                       self->ob_type->tp_name,
+                       self->ob_type->tp_name,
+                       other->ob_type->tp_name);
+               return NULL;
+       }
        res = (*func)(self, other);
        if (PyErr_Occurred())
                return NULL;