bpo-43693: Do not check co_cell2arg if a non-cell offset. (gh-26626)

This is the same fix as for PyFrame_LocalsToFast() in gh-26609, but applied to PyFrame_FastToLocalsWithError(). (It should have been in that PR.)

https://bugs.python.org/issue43693

diff --git a/Objects/frameobject.c b/Objects/frameobject.c
index a41d21780fd6e13c215734863b7b3378f61aca14..da56b551b85705bdfe474d6e21bf41797dcda095 100644 (file)
--- a/Objects/frameobject.c
+++ b/Objects/frameobject.c
@@ -981,7 +981,9 @@ PyFrame_FastToLocalsWithError(PyFrameObject *f)
         PyObject *value = fast[i];
         if (f->f_state != FRAME_CLEARED) {
             int cellargoffset = CO_CELL_NOT_AN_ARG;
-            if (co->co_cell2arg != NULL) {
+            if (kind & CO_FAST_CELL && co->co_cell2arg != NULL) {
+                assert(i - co->co_nlocals >= 0);
+                assert(i - co->co_nlocals < co->co_ncellvars);
                 cellargoffset = co->co_cell2arg[i - co->co_nlocals];
             }
             if (kind & CO_FAST_FREE) {
@@ -1093,7 +1095,8 @@ PyFrame_LocalsToFast(PyFrameObject *f, int clear)
         PyObject *oldvalue = fast[i];
         int cellargoffset = CO_CELL_NOT_AN_ARG;
         if (kind & CO_FAST_CELL && co->co_cell2arg != NULL) {
-            assert(i >= co->co_nlocals);
+            assert(i - co->co_nlocals >= 0);
+            assert(i - co->co_nlocals < co->co_ncellvars);
             cellargoffset = co->co_cell2arg[i - co->co_nlocals];
         }
         PyObject *cell = NULL;