[Python-checkins] cpython: Additional safe-guard against dereferencing NULL in reduce_newobj

[christian.heimes]

https://hg.python.org/cpython/rev/5861d9e8463d
changeset:   103371:5861d9e8463d
user:        Christian Heimes <christian at python.org>
date:        Fri Sep 09 00:21:22 2016 +0200
summary:
  Additional safe-guard against dereferencing NULL in reduce_newobj

_PyObject_GetNewArguments() can leave args == NULL but the __newobj_ex__
branch expects args to be not-NULL.

CID 1353201

files:
  Objects/typeobject.c |  8 +++++++-
  1 files changed, 7 insertions(+), 1 deletions(-)


diff --git a/Objects/typeobject.c b/Objects/typeobject.c
--- a/Objects/typeobject.c
+++ b/Objects/typeobject.c
@@ -4263,7 +4263,7 @@
         }
         Py_XDECREF(args);
     }
-    else {
+    else if (args != NULL) {
         _Py_IDENTIFIER(__newobj_ex__);
 
         newobj = _PyObject_GetAttrId(copyreg, &PyId___newobj_ex__);
@@ -4281,6 +4281,12 @@
             return NULL;
         }
     }
+    else {
+        /* args == NULL */
+        Py_DECREF(kwargs);
+        PyErr_BadInternalCall();
+        return NULL;
+    }
 
     state = _PyObject_GetState(obj,
                 !hasargs && !PyList_Check(obj) && !PyDict_Check(obj));

-- 
Repository URL: https://hg.python.org/cpython