Fix an out-of-bound index in pmerge() discovered by Zooko (SF bug

645404).  I'm not 100% sure this is the right fix, so I'll keep the
bug report open for Samuele, but this fixes the index error and passes
the test suite (and I can't see why it *shouldn't* be the right fix
:-).

Objects/typeobject.c

@@ -1067,7 +1067,8 @@ pmerge(PyObject *acc, PyObject* to_merge) {
 		}
 		for (j = 0; j < to_merge_size; j++) {
 			PyObject *j_lst = PyList_GET_ITEM(to_merge, j);
-			if (PyList_GET_ITEM(j_lst, remain[j]) == candidate) {
+			if (remain[j] < PyList_GET_SIZE(j_lst) &&
+			    PyList_GET_ITEM(j_lst, remain[j]) == candidate) {
 				remain[j]++;
 			}
 		}