Fix SF #658106, Setting __class__ to NoneType

Backport Guido's checkin 2.171:

Disallow class assignment completely unless both old and new are heap
types.  This prevents nonsense like 2.__class__ = bool or
True.__class__ = int.

diff --git a/Objects/typeobject.c b/Objects/typeobject.c
index e8ba871872ff74931dc04354ea3adc49c25f14f9..8b08bc0749c90017d15f515f411c9969d00af9a1 100644 (file)
--- a/Objects/typeobject.c
+++ b/Objects/typeobject.c
@@ -1702,6 +1702,13 @@ object_set_class(PyObject *self, PyObject *value, void *closure)
                return -1;
        }
        new = (PyTypeObject *)value;
+       if (!(new->tp_flags & Py_TPFLAGS_HEAPTYPE) ||
+           !(old->tp_flags & Py_TPFLAGS_HEAPTYPE))
+       {
+               PyErr_Format(PyExc_TypeError,
+                            "__class__ assignment: only for heap types");
+               return -1;
+       }
        newbase = new;
        oldbase = old;
        while (equiv_structs(newbase, newbase->tp_base))
@@ -1718,13 +1725,9 @@ object_set_class(PyObject *self, PyObject *value, void *closure)
                             old->tp_name);
                return -1;
        }
-       if (new->tp_flags & Py_TPFLAGS_HEAPTYPE) {
-               Py_INCREF(new);
-       }
+       Py_INCREF(new);
        self->ob_type = new;
-       if (old->tp_flags & Py_TPFLAGS_HEAPTYPE) {
-               Py_DECREF(old);
-       }
+       Py_DECREF(old);
        return 0;
 }