[Python-checkins] cpython (3.4): Issue #24735: Fix invalid memory access in combinations_with_replacement()

[raymond.hettinger]

https://hg.python.org/cpython/rev/fd3fb122c5ff
changeset:   97098:fd3fb122c5ff
branch:      3.4
parent:      97089:82ccdf2df5ac
user:        Raymond Hettinger <python at rcn.com>
date:        Tue Jul 28 02:05:44 2015 -0700
summary:
  Issue #24735: Fix invalid memory access in combinations_with_replacement()

files:
  Misc/NEWS                 |   3 +++
  Modules/itertoolsmodule.c |  12 +++++++-----
  2 files changed, 10 insertions(+), 5 deletions(-)


diff --git a/Misc/NEWS b/Misc/NEWS
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -69,6 +69,9 @@
 - Issue #23441: rcompleter now prints a tab character instead of displaying
   possible completions for an empty word.  Initial patch by Martin Sekera.
 
+- Issue #24735: Fix invalid memory access in
+  itertools.combinations_with_replacement().
+
 - Issue #17527: Add PATCH to wsgiref.validator. Patch from Luca Sbardella.
 
 - Issue #24683: Fixed crashes in _json functions called with arguments of
diff --git a/Modules/itertoolsmodule.c b/Modules/itertoolsmodule.c
--- a/Modules/itertoolsmodule.c
+++ b/Modules/itertoolsmodule.c
@@ -2787,11 +2787,13 @@
         if (result == NULL)
             goto empty;
         co->result = result;
-        elem = PyTuple_GET_ITEM(pool, 0);
-        for (i=0; i<r ; i++) {
-            assert(indices[i] == 0);
-            Py_INCREF(elem);
-            PyTuple_SET_ITEM(result, i, elem);
+        if (n > 0) {
+            elem = PyTuple_GET_ITEM(pool, 0);
+            for (i=0; i<r ; i++) {
+                assert(indices[i] == 0);
+                Py_INCREF(elem);
+                PyTuple_SET_ITEM(result, i, elem);
+            }
         }
     } else {
         /* Copy the previous result tuple or re-use it if available */

-- 
Repository URL: https://hg.python.org/cpython