From 24bd50bdcc97d65130c07d6cd26085fd06c3e972 Mon Sep 17 00:00:00 2001
From: Oren Milman <orenmn@gmail.com>
Date: Tue, 11 Sep 2018 21:46:55 +0300
Subject: [PATCH] closes bpo-31608: Fix a crash in methods of a subclass of
 _collections.deque with a bad __new__(). (GH-3788)

---
 Lib/test/test_deque.py                          | 15 +++++++++++++++
 .../2017-10-29-10-37-55.bpo-31608.wkp8Nw.rst    |  2 ++
 Modules/_collectionsmodule.c                    | 17 +++++++++++++----
 3 files changed, 30 insertions(+), 4 deletions(-)
 create mode 100644 Misc/NEWS.d/next/Library/2017-10-29-10-37-55.bpo-31608.wkp8Nw.rst

diff --git a/Lib/test/test_deque.py b/Lib/test/test_deque.py
index e895c3c9f0d..921136069d7 100644
--- a/Lib/test/test_deque.py
+++ b/Lib/test/test_deque.py
@@ -892,6 +892,21 @@ class TestSubclass(unittest.TestCase):
         d1 == d2   # not clear if this is supposed to be True or False,
                    # but it used to give a SystemError
 
+    @support.cpython_only
+    def test_bug_31608(self):
+        # The interpreter used to crash in specific cases where a deque
+        # subclass returned a non-deque.
+        class X(deque):
+            pass
+        d = X()
+        def bad___new__(cls, *args, **kwargs):
+            return [42]
+        X.__new__ = bad___new__
+        with self.assertRaises(TypeError):
+            d * 42  # shouldn't crash
+        with self.assertRaises(TypeError):
+            d + deque([1, 2, 3])  # shouldn't crash
+
 
 class SubclassWithKwargs(deque):
     def __init__(self, newarg=1):
diff --git a/Misc/NEWS.d/next/Library/2017-10-29-10-37-55.bpo-31608.wkp8Nw.rst b/Misc/NEWS.d/next/Library/2017-10-29-10-37-55.bpo-31608.wkp8Nw.rst
new file mode 100644
index 00000000000..d657a869736
--- /dev/null
+++ b/Misc/NEWS.d/next/Library/2017-10-29-10-37-55.bpo-31608.wkp8Nw.rst
@@ -0,0 +1,2 @@
+Raise a ``TypeError`` instead of crashing if a ``collections.deque`` subclass
+returns a non-deque from ``__new__``. Patch by Oren Milman.
diff --git a/Modules/_collectionsmodule.c b/Modules/_collectionsmodule.c
index c0448577140..935b4348a8f 100644
--- a/Modules/_collectionsmodule.c
+++ b/Modules/_collectionsmodule.c
@@ -478,6 +478,7 @@ deque_inplace_concat(dequeobject *deque, PyObject *other)
 static PyObject *
 deque_copy(PyObject *deque, PyObject *Py_UNUSED(ignored))
 {
+    PyObject *result;
     dequeobject *old_deque = (dequeobject *)deque;
     if (Py_TYPE(deque) == &deque_type) {
         dequeobject *new_deque;
@@ -502,11 +503,19 @@ deque_copy(PyObject *deque, PyObject *Py_UNUSED(ignored))
         return NULL;
     }
     if (old_deque->maxlen < 0)
-        return PyObject_CallFunctionObjArgs((PyObject *)(Py_TYPE(deque)),
-                                            deque, NULL);
+        result = PyObject_CallFunctionObjArgs((PyObject *)(Py_TYPE(deque)),
+                                              deque, NULL);
     else
-        return PyObject_CallFunction((PyObject *)(Py_TYPE(deque)), "Oi",
-            deque, old_deque->maxlen, NULL);
+        result = PyObject_CallFunction((PyObject *)(Py_TYPE(deque)), "Oi",
+                                       deque, old_deque->maxlen, NULL);
+    if (result != NULL && !PyObject_TypeCheck(result, &deque_type)) {
+        PyErr_Format(PyExc_TypeError,
+                     "%.200s() must return a deque, not %.200s",
+                     Py_TYPE(deque)->tp_name, Py_TYPE(result)->tp_name);
+        Py_DECREF(result);
+        return NULL;
+    }
+    return result;
 }
 
 PyDoc_STRVAR(copy_doc, "Return a shallow copy of a deque.");