commit e3f1b0911e02f5108b90b9b25417a448a423da40
author Serhiy Storchaka <storchaka@gmail.com> Sun May 08 20:46:22 2016 +0300
committer Serhiy Storchaka <storchaka@gmail.com> Sun May 08 20:46:22 2016 +0300
tree a9f0a153bfdbe33f242c3dcbcb25f6b2d31afe8e
parent 4c35964b764540988bfb342bffc7c4b1cb674031

Issue #23815: Fixed crashes related to directly created instances of types in
_tkinter and curses.panel modules.

Modules/_curses_panel.c

diff --git a/Modules/_curses_panel.c b/Modules/_curses_panel.c
index 759b731..c77e614 100644
--- a/Modules/_curses_panel.c
+++ b/Modules/_curses_panel.c
@@ -506,10 +506,11 @@
     d = PyModule_GetDict(m);
 
     /* Initialize object type */
-    _curses_panelstate(m)->PyCursesPanel_Type = \
-        PyType_FromSpec(&PyCursesPanel_Type_spec);
-    if (_curses_panelstate(m)->PyCursesPanel_Type == NULL)
+    v = PyType_FromSpec(&PyCursesPanel_Type_spec);
+    if (v == NULL)
         goto fail;
+    ((PyTypeObject *)v)->tp_new = NULL;
+    _curses_panelstate(m)->PyCursesPanel_Type = v;
 
     import_curses();
     if (PyErr_Occurred())

Modules/_tkinter.c

diff --git a/Modules/_tkinter.c b/Modules/_tkinter.c
index 41ad5f9..cf56fa8 100644
--- a/Modules/_tkinter.c
+++ b/Modules/_tkinter.c
@@ -3551,6 +3551,7 @@
         Py_DECREF(m);
         return NULL;
     }
+    ((PyTypeObject *)o)->tp_new = NULL;
     if (PyModule_AddObject(m, "TkappType", o)) {
         Py_DECREF(o);
         Py_DECREF(m);
@@ -3563,6 +3564,7 @@
         Py_DECREF(m);
         return NULL;
     }
+    ((PyTypeObject *)o)->tp_new = NULL;
     if (PyModule_AddObject(m, "TkttType", o)) {
         Py_DECREF(o);
         Py_DECREF(m);
@@ -3575,6 +3577,7 @@
         Py_DECREF(m);
         return NULL;
     }
+    ((PyTypeObject *)o)->tp_new = NULL;
     if (PyModule_AddObject(m, "Tcl_Obj", o)) {
         Py_DECREF(o);
         Py_DECREF(m);