Issue #24735: Fix invalid memory access in combinations_with_replacement()

diff --git a/Misc/NEWS b/Misc/NEWS
index 9bacb3ab03e84518f1232ebaef8e75ba8cd9ff47..c2b6fd17a59e1b92bc8b7cd01346da13323d7c52 100644 (file)
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -69,6 +69,9 @@ Library
 - Issue #23441: rcompleter now prints a tab character instead of displaying
   possible completions for an empty word.  Initial patch by Martin Sekera.
 
+- Issue #24735: Fix invalid memory access in
+  itertools.combinations_with_replacement().
+
 - Issue #17527: Add PATCH to wsgiref.validator. Patch from Luca Sbardella.
 
 - Issue #24683: Fixed crashes in _json functions called with arguments of

diff --git a/Modules/itertoolsmodule.c b/Modules/itertoolsmodule.c
index 6634a1799f44568a6220df69ecaffaa5133aef66..f5fa3fb3bb32a64c89f332b6ce55a134ab9eb3d6 100644 (file)
--- a/Modules/itertoolsmodule.c
+++ b/Modules/itertoolsmodule.c
@@ -2787,11 +2787,13 @@ cwr_next(cwrobject *co)
         if (result == NULL)
             goto empty;
         co->result = result;
-        elem = PyTuple_GET_ITEM(pool, 0);
-        for (i=0; i<r ; i++) {
-            assert(indices[i] == 0);
-            Py_INCREF(elem);
-            PyTuple_SET_ITEM(result, i, elem);
+        if (n > 0) {
+            elem = PyTuple_GET_ITEM(pool, 0);
+            for (i=0; i<r ; i++) {
+                assert(indices[i] == 0);
+                Py_INCREF(elem);
+                PyTuple_SET_ITEM(result, i, elem);
+            }
         }
     } else {
         /* Copy the previous result tuple or re-use it if available */