gh-143006: add type check in float_richcompare()

Author: skirpichev

Lib/test/test_float.py

@@ -651,6 +651,14 @@ class F(float, H):
         value = F('nan')
         self.assertEqual(hash(value), object.__hash__(value))
 
+    def test_issue_gh143006(self):
+        class EvilInt(int):
+            def __neg__(self):
+                return
+
+        i = -1<<50
+        self.assertRaises(TypeError, operator.ge, float(i), EvilInt(i))
+
 
 @unittest.skipUnless(hasattr(float, "__getformat__"), "requires __getformat__")
 class FormatFunctionsTestCase(unittest.TestCase):

Misc/NEWS.d/next/Core_and_Builtins/2025-12-22-01-09-15.gh-issue-143006.TbNYHd.rst

@@ -0,0 +1,3 @@
+Add missing type check for rich comparison methods of the :class:`float` to
+avoid possible crash with integer operand, having broken implementation of
+the :meth:`object.__neg__` method.

Objects/floatobject.c

@@ -473,6 +473,12 @@ float_richcompare(PyObject *v, PyObject *w, int op)
                 ww = PyNumber_Negative(w);
                 if (ww == NULL)
                     goto Error;
+                else if (!PyLong_Check(ww)) {
+                    PyErr_SetString(PyExc_TypeError,
+                                    "unexpected type from negation "
+                                    "of integer operand");
+                    goto Error;
+                }
             }
             else
                 Py_INCREF(ww);