python
diff --git a/‎Lib/test/test_int.py‎
Lines changed: 12 additions & 0 deletions b/‎Lib/test/test_int.py‎
Lines changed: 12 additions & 0 deletions
diff --git a/‎Misc/NEWS.d/next/Core_and_Builtins/2025-12-13-17-20-38.gh-issue-142554.wNtEFF.rst‎
Lines changed: 2 additions & 0 deletions b/‎Misc/NEWS.d/next/Core_and_Builtins/2025-12-13-17-20-38.gh-issue-142554.wNtEFF.rst‎
Lines changed: 2 additions & 0 deletions
diff --git a/‎Objects/longobject.c‎
Lines changed: 2 additions & 2 deletions b/‎Objects/longobject.c‎
Lines changed: 2 additions & 2 deletions
@@ -778,6 +778,18 @@ def test_pylong_int_divmod(self):
         a, b = divmod(n*3 + 1, n)
         assert a == 3 and b == 1
 
+    @support.cpython_only  # tests implementation details of CPython.
+    @unittest.skipUnless(_pylong, "_pylong module required")
+    def test_pylong_int_divmod_crash(self):
+        # Regression test for https://github.com/python/cpython/issues/142554.
+        bad_int_divmod = lambda a, b: (1,)
+        # 'k' chosen such that divmod(2**(2*k), 2**k) uses _pylong.int_divmod()
+        k = 10_000
+        a, b = (1 << (2 * k)), (1 << k)
+        with mock.patch.object(_pylong, "int_divmod", wraps=bad_int_divmod):
+            msg = r"tuple of length 2 is required from int_divmod\(\)"
+            self.assertRaisesRegex(ValueError, msg, divmod, a, b)
+
     def test_pylong_str_to_int(self):
         v1 = 1 << 100_000
         s = str(v1)
 
@@ -0,0 +1,2 @@
+Fix a crash in :func:`divmod` when :func:`!_pylong.int_divmod` does not
+return a tuple of length two exactly. Patch by Bénédikt Tran.
@@ -4339,10 +4339,10 @@ pylong_int_divmod(PyLongObject *v, PyLongObject *w,
     if (result == NULL) {
         return -1;
     }
-    if (!PyTuple_Check(result)) {
+    if (!PyTuple_Check(result) || PyTuple_GET_SIZE(result) != 2) {
         Py_DECREF(result);
         PyErr_SetString(PyExc_ValueError,
-                        "tuple is required from int_divmod()");
+                        "tuple of length 2 is required from int_divmod()");
         return -1;
     }
     PyObject *q = PyTuple_GET_ITEM(result, 0);
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	+Fix a crash in :func:`divmod` when :func:`!_pylong.int_divmod` does not
	`2`	`+return a tuple of length two exactly. Patch by Bénédikt Tran.`
Original file line number	Diff line number	Diff line change
`@@ -4339,10 +4339,10 @@ pylong_int_divmod(PyLongObject v, PyLongObject w,`
`4339`	`4339`	`if (result == NULL) {`
`4340`	`4340`	`return -1;`
`4341`	`4341`	`}`
`4342`		`- if (!PyTuple_Check(result)) {`
	`4342`	`+ if (!PyTuple_Check(result) \|\| PyTuple_GET_SIZE(result) != 2) {`
`4343`	`4343`	`Py_DECREF(result);`
`4344`	`4344`	`PyErr_SetString(PyExc_ValueError,`
`4345`		`- "tuple is required from int_divmod()");`
	`4345`	`+ "tuple of length 2 is required from int_divmod()");`
`4346`	`4346`	`return -1;`
`4347`	`4347`	`}`
`4348`	`4348`	`PyObject *q = PyTuple_GET_ITEM(result, 0);`