wrap_cmpfunc(): added a safety check for the __cmp__ wrapper. We can
only safely call a type's tp_compare slot if the second argument is
also an instance of the same type. I hate to think what
e.g. int_compare() would do with a second argument that's a float!
diff --git a/Objects/typeobject.c b/Objects/typeobject.c
index 6200a83..792a9f3 100644
--- a/Objects/typeobject.c
+++ b/Objects/typeobject.c
@@ -2033,6 +2033,15 @@
if (!PyArg_ParseTuple(args, "O", &other))
return NULL;
+ if (!PyType_IsSubtype(other->ob_type, self->ob_type)) {
+ PyErr_Format(
+ PyExc_TypeError,
+ "%s.__cmp__(x,y) requires y to be a '%s', not a '%s'",
+ self->ob_type->tp_name,
+ self->ob_type->tp_name,
+ other->ob_type->tp_name);
+ return NULL;
+ }
res = (*func)(self, other);
if (PyErr_Occurred())
return NULL;