Index: Objects/typeobject.c
===================================================================
--- Objects/typeobject.c	(revision 69408)
+++ Objects/typeobject.c	(working copy)
@@ -4603,6 +4603,11 @@
 
 	if (res == NULL)
 		return -1;
+	if (!PyLong_Check(res)) {
+		PyErr_SetString(PyExc_TypeError,
+				"__len__ returned non int value");
+		return -1;
+	}
 	len = PyLong_AsSsize_t(res);
 	Py_DECREF(res);
 	if (len < 0) {
Index: Lib/test/test_builtin.py
===================================================================
--- Lib/test/test_builtin.py	(revision 69408)
+++ Lib/test/test_builtin.py	(working copy)
@@ -611,6 +611,10 @@
             def __len__(self):
                 raise ValueError
         self.assertRaises(ValueError, len, BadSeq())
+        class InvalidLen:
+            def __len__(self):
+                return None
+        self.assertRaises(TypeError, len, InvalidLen())
 
     def test_map(self):
         self.assertEqual(