diff --git a/Lib/test/test_float.py b/Lib/test/test_float.py index 00518abcb11b46..25ce7f7f0d9774 100644 --- a/Lib/test/test_float.py +++ b/Lib/test/test_float.py @@ -651,6 +651,14 @@ class F(float, H): value = F('nan') self.assertEqual(hash(value), object.__hash__(value)) + def test_issue_gh143006(self): + class EvilInt(int): + def __neg__(self): + return + + i = -1<<50 + self.assertRaises(TypeError, operator.ge, float(i), EvilInt(i)) + @unittest.skipUnless(hasattr(float, "__getformat__"), "requires __getformat__") class FormatFunctionsTestCase(unittest.TestCase): diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2025-12-22-01-09-15.gh-issue-143006.TbNYHd.rst b/Misc/NEWS.d/next/Core_and_Builtins/2025-12-22-01-09-15.gh-issue-143006.TbNYHd.rst new file mode 100644 index 00000000000000..7503c3d1dbd3a8 --- /dev/null +++ b/Misc/NEWS.d/next/Core_and_Builtins/2025-12-22-01-09-15.gh-issue-143006.TbNYHd.rst @@ -0,0 +1,3 @@ +Add missing type check for rich comparison methods of the :class:`float` to +avoid possible crash with integer operand, having broken implementation of +the :meth:`object.__neg__` method. diff --git a/Objects/floatobject.c b/Objects/floatobject.c index 2cb690748d9de4..3869fe19c37342 100644 --- a/Objects/floatobject.c +++ b/Objects/floatobject.c @@ -473,6 +473,13 @@ float_richcompare(PyObject *v, PyObject *w, int op) ww = PyNumber_Negative(w); if (ww == NULL) goto Error; + else if (!PyLong_Check(ww)) { + PyErr_Format(PyExc_TypeError, + "unexpected type from negation " + "of integer operand; expected int, got %T", + ww); + goto Error; + } } else Py_INCREF(ww);