From: Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com>
Date: Sat, 14 Mar 2026 10:35:41 +0000 (+0100)
Subject: [3.14] gh-143636: fix a crash when calling ``__replace__`` on invalid `SimpleNamespac... 
X-Git-Tag: v3.14.4~141
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=1749b3c6868deab6888d1aea68a00b28ae729696;p=thirdparty%2FPython%2Fcpython.git

[3.14] gh-143636: fix a crash when calling ``__replace__`` on invalid `SimpleNamespace` instances (GH-143655) (#145938)

gh-143636: fix a crash when calling ``__replace__`` on invalid `SimpleNamespace` instances (GH-143655)
(cherry picked from commit 97968564b61965f2a65a9be8af731cee6913eb7a)

Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
---

diff --git a/Lib/test/test_types.py b/Lib/test/test_types.py
index a478fd5a4795..bf10dc2e3170 100644
--- a/Lib/test/test_types.py
+++ b/Lib/test/test_types.py
@@ -2113,6 +2113,21 @@ class SimpleNamespaceTests(unittest.TestCase):
         self.assertIs(type(spam2), Spam)
         self.assertEqual(vars(spam2), {'ham': 5, 'eggs': 9})
 
+    def test_replace_invalid_subtype(self):
+        # See https://github.com/python/cpython/issues/143636.
+        class MyNS(types.SimpleNamespace):
+            def __new__(cls, *args, **kwargs):
+                if created:
+                    return 12345
+                return super().__new__(cls)
+
+        created = False
+        ns = MyNS()
+        created = True
+        err = (r"^expect types\.SimpleNamespace type, "
+               r"but .+\.MyNS\(\) returned 'int' object")
+        self.assertRaisesRegex(TypeError, err, copy.replace, ns)
+
     def test_fake_namespace_compare(self):
         # Issue #24257: Incorrect use of PyObject_IsInstance() caused
         # SystemError.
diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-01-10-12-59-58.gh-issue-143636.dzr26e.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-01-10-12-59-58.gh-issue-143636.dzr26e.rst
new file mode 100644
index 000000000000..4d5249ffe3a2
--- /dev/null
+++ b/Misc/NEWS.d/next/Core_and_Builtins/2026-01-10-12-59-58.gh-issue-143636.dzr26e.rst
@@ -0,0 +1,2 @@
+Fix a crash when calling :class:`SimpleNamespace.__replace__()
+<types.SimpleNamespace>` on non-namespace instances. Patch by Bénédikt Tran.
diff --git a/Objects/namespaceobject.c b/Objects/namespaceobject.c
index 0fc2bcea4cb0..f39f1b35ebb6 100644
--- a/Objects/namespaceobject.c
+++ b/Objects/namespaceobject.c
@@ -13,6 +13,7 @@ typedef struct {
 } _PyNamespaceObject;
 
 #define _PyNamespace_CAST(op) _Py_CAST(_PyNamespaceObject*, (op))
+#define _PyNamespace_Check(op) PyObject_TypeCheck((op), &_PyNamespace_Type)
 
 
 static PyMemberDef namespace_members[] = {
@@ -230,6 +231,14 @@ namespace_replace(PyObject *self, PyObject *args, PyObject *kwargs)
     if (!result) {
         return NULL;
     }
+    if (!_PyNamespace_Check(result)) {
+        PyErr_Format(PyExc_TypeError,
+                     "expect %N type, but %T() returned '%T' object",
+                     &_PyNamespace_Type, self, result);
+        Py_DECREF(result);
+        return NULL;
+    }
+
     if (PyDict_Update(((_PyNamespaceObject*)result)->ns_dict,
                       ((_PyNamespaceObject*)self)->ns_dict) < 0)
     {