bpo-30640: Fix undefined behavior in _PyFunction_FastCallDict() and PyEval_EvalCodeEx...

k + 1 was calculated with k = NULL.

diff --git a/Objects/call.c b/Objects/call.c
index c3cc31dba9b6cd85803b65376fef9267442839fd..3b08cb25926497066ea2e955112ea732c08b0886 100644 (file)
--- a/Objects/call.c
+++ b/Objects/call.c
@@ -374,7 +374,7 @@ _PyFunction_FastCallDict(PyObject *func, PyObject **args, Py_ssize_t nargs,
 
     result = _PyEval_EvalCodeWithName((PyObject*)co, globals, (PyObject *)NULL,
                                       args, nargs,
-                                      k, k + 1, nk, 2,
+                                      k, k != NULL ? k + 1 : NULL, nk, 2,
                                       d, nd, kwdefs,
                                       closure, name, qualname);
     Py_XDECREF(kwtuple);

diff --git a/Python/ceval.c b/Python/ceval.c
index 59fc070f9e7ebda85e6a3086278323e0a18c688e..dd90e18a85568a30fd711b3bca0433daee5185a0 100644 (file)
--- a/Python/ceval.c
+++ b/Python/ceval.c
@@ -4220,7 +4220,8 @@ PyEval_EvalCodeEx(PyObject *_co, PyObject *globals, PyObject *locals,
 {
     return _PyEval_EvalCodeWithName(_co, globals, locals,
                                     args, argcount,
-                                    kws, kws + 1, kwcount, 2,
+                                    kws, kws != NULL ? kws + 1 : NULL,
+                                    kwcount, 2,
                                     defs, defcount,
                                     kwdefs, closure,
                                     NULL, NULL);