From 43657bf235f8085b695ce44e5c3b018520596cf8 Mon Sep 17 00:00:00 2001 From: Sergey B Kirpichev Date: Mon, 22 Dec 2025 01:09:24 +0300 Subject: [PATCH 1/2] gh-143006: add type check in float_richcompare() --- Lib/test/test_float.py | 8 ++++++++ .../2025-12-22-01-09-15.gh-issue-143006.TbNYHd.rst | 3 +++ Objects/floatobject.c | 6 ++++++ 3 files changed, 17 insertions(+) create mode 100644 Misc/NEWS.d/next/Core_and_Builtins/2025-12-22-01-09-15.gh-issue-143006.TbNYHd.rst diff --git a/Lib/test/test_float.py b/Lib/test/test_float.py index 00518abcb11b46..25ce7f7f0d9774 100644 --- a/Lib/test/test_float.py +++ b/Lib/test/test_float.py @@ -651,6 +651,14 @@ class F(float, H): value = F('nan') self.assertEqual(hash(value), object.__hash__(value)) + def test_issue_gh143006(self): + class EvilInt(int): + def __neg__(self): + return + + i = -1<<50 + self.assertRaises(TypeError, operator.ge, float(i), EvilInt(i)) + @unittest.skipUnless(hasattr(float, "__getformat__"), "requires __getformat__") class FormatFunctionsTestCase(unittest.TestCase): diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2025-12-22-01-09-15.gh-issue-143006.TbNYHd.rst b/Misc/NEWS.d/next/Core_and_Builtins/2025-12-22-01-09-15.gh-issue-143006.TbNYHd.rst new file mode 100644 index 00000000000000..7503c3d1dbd3a8 --- /dev/null +++ b/Misc/NEWS.d/next/Core_and_Builtins/2025-12-22-01-09-15.gh-issue-143006.TbNYHd.rst @@ -0,0 +1,3 @@ +Add missing type check for rich comparison methods of the :class:`float` to +avoid possible crash with integer operand, having broken implementation of +the :meth:`object.__neg__` method. diff --git a/Objects/floatobject.c b/Objects/floatobject.c index 2cb690748d9de4..b7cca2e43dd3a7 100644 --- a/Objects/floatobject.c +++ b/Objects/floatobject.c @@ -473,6 +473,12 @@ float_richcompare(PyObject *v, PyObject *w, int op) ww = PyNumber_Negative(w); if (ww == NULL) goto Error; + else if (!PyLong_Check(ww)) { + PyErr_SetString(PyExc_TypeError, + "unexpected type from negation " + "of integer operand"); + goto Error; + } } else Py_INCREF(ww); From 490cd3fac1e39eb20e5cb2edd37a25b7f740eeab Mon Sep 17 00:00:00 2001 From: Sergey B Kirpichev Date: Mon, 22 Dec 2025 15:40:50 +0300 Subject: [PATCH 2/2] Update Objects/floatobject.c Co-authored-by: Victor Stinner --- Objects/floatobject.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/Objects/floatobject.c b/Objects/floatobject.c index b7cca2e43dd3a7..3869fe19c37342 100644 --- a/Objects/floatobject.c +++ b/Objects/floatobject.c @@ -474,9 +474,10 @@ float_richcompare(PyObject *v, PyObject *w, int op) if (ww == NULL) goto Error; else if (!PyLong_Check(ww)) { - PyErr_SetString(PyExc_TypeError, - "unexpected type from negation " - "of integer operand"); + PyErr_Format(PyExc_TypeError, + "unexpected type from negation " + "of integer operand; expected int, got %T", + ww); goto Error; } }