From e3f1b0911e02f5108b90b9b25417a448a423da40 Mon Sep 17 00:00:00 2001
From: Serhiy Storchaka <storchaka@gmail.com>
Date: Sun, 8 May 2016 20:46:22 +0300
Subject: [PATCH] Issue #23815: Fixed crashes related to directly created
 instances of types in _tkinter and curses.panel modules.

---
 Lib/test/test_curses.py | 4 ++++
 Lib/test/test_tcl.py    | 2 ++
 Misc/NEWS               | 3 +++
 Modules/_curses_panel.c | 7 ++++---
 Modules/_tkinter.c      | 3 +++
 5 files changed, 16 insertions(+), 3 deletions(-)

diff --git a/Lib/test/test_curses.py b/Lib/test/test_curses.py
index 27470415200..222105ed755 100644
--- a/Lib/test/test_curses.py
+++ b/Lib/test/test_curses.py
@@ -285,6 +285,10 @@ class TestCurses(unittest.TestCase):
         panel.set_userptr(A())
         panel.set_userptr(None)
 
+    def test_new_curses_panel(self):
+        panel = curses.panel.new_panel(self.stdscr)
+        self.assertRaises(TypeError, type(panel))
+
     @unittest.skipUnless(hasattr(curses, 'resizeterm'),
                            'resizeterm not available')
     def test_resize_term(self):
diff --git a/Lib/test/test_tcl.py b/Lib/test/test_tcl.py
index 25f6edecf5f..8ffd1853147 100644
--- a/Lib/test/test_tcl.py
+++ b/Lib/test/test_tcl.py
@@ -649,6 +649,8 @@ class TclTest(unittest.TestCase):
                 expected = {'a': (1, 2, 3), 'something': 'foo', 'status': ''}
             self.assertEqual(splitdict(tcl, arg), expected)
 
+    def test_new_tcl_obj(self):
+        self.assertRaises(TypeError, _tkinter.Tcl_Obj)
 
 class BigmemTclTest(unittest.TestCase):
 
diff --git a/Misc/NEWS b/Misc/NEWS
index f31b1721e33..870f5a3e82f 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -116,6 +116,9 @@ Core and Builtins
 Library
 -------
 
+- Issue #23815: Fixed crashes related to directly created instances of types in
+  _tkinter and curses.panel modules.
+
 - Issue #17765: weakref.ref() no longer silently ignores keyword arguments.
   Patch by Georg Brandl.
 
diff --git a/Modules/_curses_panel.c b/Modules/_curses_panel.c
index 759b73109d2..c77e614724e 100644
--- a/Modules/_curses_panel.c
+++ b/Modules/_curses_panel.c
@@ -506,10 +506,11 @@ PyInit__curses_panel(void)
     d = PyModule_GetDict(m);
 
     /* Initialize object type */
-    _curses_panelstate(m)->PyCursesPanel_Type = \
-        PyType_FromSpec(&PyCursesPanel_Type_spec);
-    if (_curses_panelstate(m)->PyCursesPanel_Type == NULL)
+    v = PyType_FromSpec(&PyCursesPanel_Type_spec);
+    if (v == NULL)
         goto fail;
+    ((PyTypeObject *)v)->tp_new = NULL;
+    _curses_panelstate(m)->PyCursesPanel_Type = v;
 
     import_curses();
     if (PyErr_Occurred())
diff --git a/Modules/_tkinter.c b/Modules/_tkinter.c
index 41ad5f91f7e..cf56fa836ac 100644
--- a/Modules/_tkinter.c
+++ b/Modules/_tkinter.c
@@ -3551,6 +3551,7 @@ PyInit__tkinter(void)
         Py_DECREF(m);
         return NULL;
     }
+    ((PyTypeObject *)o)->tp_new = NULL;
     if (PyModule_AddObject(m, "TkappType", o)) {
         Py_DECREF(o);
         Py_DECREF(m);
@@ -3563,6 +3564,7 @@ PyInit__tkinter(void)
         Py_DECREF(m);
         return NULL;
     }
+    ((PyTypeObject *)o)->tp_new = NULL;
     if (PyModule_AddObject(m, "TkttType", o)) {
         Py_DECREF(o);
         Py_DECREF(m);
@@ -3575,6 +3577,7 @@ PyInit__tkinter(void)
         Py_DECREF(m);
         return NULL;
     }
+    ((PyTypeObject *)o)->tp_new = NULL;
     if (PyModule_AddObject(m, "Tcl_Obj", o)) {
         Py_DECREF(o);
         Py_DECREF(m);