From 08d230a5408e9fac3adbb357f5fb4a43958991d4 Mon Sep 17 00:00:00 2001
From: Serhiy Storchaka <storchaka@gmail.com>
Date: Fri, 22 May 2015 11:02:49 +0300
Subject: [PATCH] Issue #24257: Fixed incorrect uses of PyObject_IsInstance().
 Fixed segmentation fault in sqlite3.Row constructor with faked cursor type.
 Fixed system error in the comparison of faked types.SimpleNamespace.

---
 Lib/sqlite3/test/factory.py |  8 ++++++++
 Lib/test/test_types.py      | 16 ++++++++++++++++
 Misc/NEWS                   |  6 ++++++
 Modules/_sqlite/row.c       |  2 +-
 Objects/genobject.c         |  5 ++---
 Objects/namespaceobject.c   |  7 +++----
 6 files changed, 36 insertions(+), 8 deletions(-)

diff --git a/Lib/sqlite3/test/factory.py b/Lib/sqlite3/test/factory.py
index 98dcae5d6c4..a8348b4626f 100644
--- a/Lib/sqlite3/test/factory.py
+++ b/Lib/sqlite3/test/factory.py
@@ -162,6 +162,14 @@ def CheckSqliteRowAsSequence(self):
         self.assertEqual(list(reversed(row)), list(reversed(as_tuple)))
         self.assertIsInstance(row, Sequence)
 
+    def CheckFakeCursorClass(self):
+        # Issue #24257: Incorrect use of PyObject_IsInstance() caused
+        # segmentation fault.
+        class FakeCursor(str):
+            __class__ = sqlite.Cursor
+        cur = self.con.cursor(factory=FakeCursor)
+        self.assertRaises(TypeError, sqlite.Row, cur, ())
+
     def tearDown(self):
         self.con.close()
 
diff --git a/Lib/test/test_types.py b/Lib/test/test_types.py
index ec10752e6a2..849cba96496 100644
--- a/Lib/test/test_types.py
+++ b/Lib/test/test_types.py
@@ -1169,6 +1169,22 @@ def test_pickle(self):
 
             self.assertEqual(ns, ns_roundtrip, pname)
 
+    def test_fake_namespace_compare(self):
+        # Issue #24257: Incorrect use of PyObject_IsInstance() caused
+        # SystemError.
+        class FakeSimpleNamespace(str):
+            __class__ = types.SimpleNamespace
+        self.assertFalse(types.SimpleNamespace() == FakeSimpleNamespace())
+        self.assertTrue(types.SimpleNamespace() != FakeSimpleNamespace())
+        with self.assertRaises(TypeError):
+            types.SimpleNamespace() < FakeSimpleNamespace()
+        with self.assertRaises(TypeError):
+            types.SimpleNamespace() <= FakeSimpleNamespace()
+        with self.assertRaises(TypeError):
+            types.SimpleNamespace() > FakeSimpleNamespace()
+        with self.assertRaises(TypeError):
+            types.SimpleNamespace() >= FakeSimpleNamespace()
+
 
 def test_main():
     run_unittest(TypesTests, MappingProxyTests, ClassCreationTests,
diff --git a/Misc/NEWS b/Misc/NEWS
index 0593d89c43d..6b491d003a3 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -10,6 +10,9 @@ Release date: tba
 Core and Builtins
 -----------------
 
+- Issue #24257: Fixed system error in the comparison of faked
+  types.SimpleNamespace.
+
 - Issue #22939: Fixed integer overflow in iterator object.  Patch by
   Clement Rouault.
 
@@ -56,6 +59,9 @@ Core and Builtins
 Library
 -------
 
+- Issue #24257: Fixed segmentation fault in sqlite3.Row constructor with faked
+  cursor type.
+
 - Issue #22107: tempfile.gettempdir() and tempfile.mkdtemp() now try again
   when a directory with the chosen name already exists on Windows as well as
   on Unix.  tempfile.mkstemp() now fails early if parent directory is not
diff --git a/Modules/_sqlite/row.c b/Modules/_sqlite/row.c
index 64dfd06dffb..ee734460068 100644
--- a/Modules/_sqlite/row.c
+++ b/Modules/_sqlite/row.c
@@ -46,7 +46,7 @@ pysqlite_row_new(PyTypeObject *type, PyObject *args, PyObject *kwargs)
     if (!PyArg_ParseTuple(args, "OO", &cursor, &data))
         return NULL;
 
-    if (!PyObject_IsInstance((PyObject*)cursor, (PyObject*)&pysqlite_CursorType)) {
+    if (!PyObject_TypeCheck((PyObject*)cursor, &pysqlite_CursorType)) {
         PyErr_SetString(PyExc_TypeError, "instance of cursor required for first argument");
         return NULL;
     }
diff --git a/Objects/genobject.c b/Objects/genobject.c
index f125847bd79..67e6ef9e001 100644
--- a/Objects/genobject.c
+++ b/Objects/genobject.c
@@ -398,8 +398,7 @@ _PyGen_FetchStopIterationValue(PyObject **pvalue) {
         PyErr_Fetch(&et, &ev, &tb);
         if (ev) {
             /* exception will usually be normalised already */
-            if (Py_TYPE(ev) == (PyTypeObject *) et
-                || PyObject_IsInstance(ev, PyExc_StopIteration)) {
+            if (PyObject_TypeCheck(ev, (PyTypeObject *) et)) {
                 value = ((PyStopIterationObject *)ev)->value;
                 Py_INCREF(value);
                 Py_DECREF(ev);
@@ -409,7 +408,7 @@ _PyGen_FetchStopIterationValue(PyObject **pvalue) {
             } else {
                 /* normalisation required */
                 PyErr_NormalizeException(&et, &ev, &tb);
-                if (!PyObject_IsInstance(ev, PyExc_StopIteration)) {
+                if (!PyObject_TypeCheck(ev, (PyTypeObject *)PyExc_StopIteration)) {
                     PyErr_Restore(et, ev, tb);
                     return -1;
                 }
diff --git a/Objects/namespaceobject.c b/Objects/namespaceobject.c
index 720ac0d30fc..3d27a95f1fe 100644
--- a/Objects/namespaceobject.c
+++ b/Objects/namespaceobject.c
@@ -164,12 +164,11 @@ namespace_clear(_PyNamespaceObject *ns)
 static PyObject *
 namespace_richcompare(PyObject *self, PyObject *other, int op)
 {
-    if (PyObject_IsInstance(self, (PyObject *)&_PyNamespace_Type) &&
-            PyObject_IsInstance(other, (PyObject *)&_PyNamespace_Type))
+    if (PyObject_TypeCheck(self, &_PyNamespace_Type) &&
+        PyObject_TypeCheck(other, &_PyNamespace_Type))
         return PyObject_RichCompare(((_PyNamespaceObject *)self)->ns_dict,
                                    ((_PyNamespaceObject *)other)->ns_dict, op);
-    Py_INCREF(Py_NotImplemented);
-    return Py_NotImplemented;
+    Py_RETURN_NOTIMPLEMENTED;
 }