From: Raymond Hettinger <python@rcn.com>
Date: Tue, 28 Jul 2015 09:05:44 +0000 (-0700)
Subject: Issue #24735: Fix invalid memory access in combinations_with_replacement()
X-Git-Tag: v3.5.0rc1~82^2
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=acd61b6e4092b316069a526930d8b3d43c1a14df;p=thirdparty%2FPython%2Fcpython.git

Issue #24735: Fix invalid memory access in combinations_with_replacement()
---

diff --git a/Misc/NEWS b/Misc/NEWS
index 9bacb3ab03e8..c2b6fd17a59e 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -69,6 +69,9 @@ Library
 - Issue #23441: rcompleter now prints a tab character instead of displaying
   possible completions for an empty word.  Initial patch by Martin Sekera.
 
+- Issue #24735: Fix invalid memory access in
+  itertools.combinations_with_replacement().
+
 - Issue #17527: Add PATCH to wsgiref.validator. Patch from Luca Sbardella.
 
 - Issue #24683: Fixed crashes in _json functions called with arguments of
diff --git a/Modules/itertoolsmodule.c b/Modules/itertoolsmodule.c
index 6634a1799f44..f5fa3fb3bb32 100644
--- a/Modules/itertoolsmodule.c
+++ b/Modules/itertoolsmodule.c
@@ -2787,11 +2787,13 @@ cwr_next(cwrobject *co)
         if (result == NULL)
             goto empty;
         co->result = result;
-        elem = PyTuple_GET_ITEM(pool, 0);
-        for (i=0; i<r ; i++) {
-            assert(indices[i] == 0);
-            Py_INCREF(elem);
-            PyTuple_SET_ITEM(result, i, elem);
+        if (n > 0) {
+            elem = PyTuple_GET_ITEM(pool, 0);
+            for (i=0; i<r ; i++) {
+                assert(indices[i] == 0);
+                Py_INCREF(elem);
+                PyTuple_SET_ITEM(result, i, elem);
+            }
         }
     } else {
         /* Copy the previous result tuple or re-use it if available */