diff options
| author | Brad Larsen <brad@bradfordlarsen.com> | 2019-04-01 14:36:05 (GMT) |
|---|---|---|
| committer | Guido van Rossum <guido@python.org> | 2019-04-01 14:36:05 (GMT) |
| commit | a4d78362397fc3bced6ea80fbc7b5f4827aec55e (patch) | |
| tree | 48884a58dc472e2ca0d447af4028461f6124c104 | |
| parent | 10654c19b5e6efdf3c529ff9bf7bcab89bdca1c1 (diff) | |
| download | cpython-a4d78362397fc3bced6ea80fbc7b5f4827aec55e.zip cpython-a4d78362397fc3bced6ea80fbc7b5f4827aec55e.tar.gz cpython-a4d78362397fc3bced6ea80fbc7b5f4827aec55e.tar.bz2 | |
bpo-36495: Fix two out-of-bounds array reads (GH-12641)
Research and fix by @bradlarsen.
| -rw-r--r-- | Python/ast.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/Python/ast.c b/Python/ast.c index e9154fe..913e53a 100644 --- a/Python/ast.c +++ b/Python/ast.c @@ -1400,7 +1400,7 @@ handle_keywordonly_args(struct compiling *c, const node *n, int start, goto error; asdl_seq_SET(kwonlyargs, j++, arg); i += 1; /* the name */ - if (TYPE(CHILD(n, i)) == COMMA) + if (i < NCH(n) && TYPE(CHILD(n, i)) == COMMA) i += 1; /* the comma, if present */ break; case TYPE_COMMENT: @@ -1599,7 +1599,7 @@ ast_for_arguments(struct compiling *c, const node *n) if (!kwarg) return NULL; i += 2; /* the double star and the name */ - if (TYPE(CHILD(n, i)) == COMMA) + if (i < NCH(n) && TYPE(CHILD(n, i)) == COMMA) i += 1; /* the comma, if present */ break; case TYPE_COMMENT: |