Additional safe-guard against dereferencing NULL in reduce_newobj

_PyObject_GetNewArguments() can leave args == NULL but the __newobj_ex__
branch expects args to be not-NULL.

CID 1353201

1 files changed, 7 insertions, 1 deletions

diff --git a/Objects/typeobject.c b/Objects/typeobject.c
index 209d4fa..ae59363 100644
--- a/Objects/typeobject.c
+++ b/Objects/typeobject.c
@@ -4263,7 +4263,7 @@ reduce_newobj(PyObject *obj)
         }
         Py_XDECREF(args);
     }
-    else {
+    else if (args != NULL) {
         _Py_IDENTIFIER(__newobj_ex__);
 
         newobj = _PyObject_GetAttrId(copyreg, &PyId___newobj_ex__);
@@ -4281,6 +4281,12 @@ reduce_newobj(PyObject *obj)
             return NULL;
         }
     }
+    else {
+        /* args == NULL */
+        Py_DECREF(kwargs);
+        PyErr_BadInternalCall();
+        return NULL;
+    }
 
     state = _PyObject_GetState(obj,
                 !hasargs && !PyList_Check(obj) && !PyDict_Check(obj));