Issue #27286: Fixed compiling BUILD_MAP_UNPACK_WITH_CALL opcode. Calling

serhiy-storchaka · serhiy-storchaka · commit 3c317e76a2fe · 2016-06-12T09:22:01.000+03:00
function with generalized unpacking (PEP 448) and conflicting keyword names
could cause undefined behavior.
diff --git a/Lib/importlib/_bootstrap_external.py b/Lib/importlib/_bootstrap_external.py
@@ -223,6 +223,7 @@ def _write_atomic(path, data, mode=0o666):
 #     Python 3.5b1  3330 (PEP 448: Additional Unpacking Generalizations)
 #     Python 3.5b2  3340 (fix dictionary display evaluation order #11205)
 #     Python 3.5b2  3350 (add GET_YIELD_FROM_ITER opcode #24400)
+#     Python 3.5.2  3351 (fix BUILD_MAP_UNPACK_WITH_CALL opcode #27286)
 #
 # MAGIC must change whenever the bytecode emitted by the compiler may no
 # longer be understood by older implementations of the eval loop (usually
@@ -231,7 +232,7 @@ def _write_atomic(path, data, mode=0o666):
 # Whenever MAGIC_NUMBER is changed, the ranges in the magic_values array
 # in PC/launcher.c must also be updated.
 
-MAGIC_NUMBER = (3350).to_bytes(2, 'little') + b'\r\n'
+MAGIC_NUMBER = (3351).to_bytes(2, 'little') + b'\r\n'
 _RAW_MAGIC_NUMBER = int.from_bytes(MAGIC_NUMBER, 'little')  # For import.c
 
 _PYCACHE = '__pycache__'
diff --git a/Lib/test/test_extcall.py b/Lib/test/test_extcall.py
@@ -57,6 +57,10 @@
     Traceback (most recent call last):
         ...
     TypeError: f() got multiple values for keyword argument 'a'
+    >>> f(1, 2, a=3, **{'a': 4}, **{'a': 5})
+    Traceback (most recent call last):
+        ...
+    TypeError: f() got multiple values for keyword argument 'a'
     >>> f(1, 2, 3, *[4, 5], **{'a':6, 'b':7})
     (1, 2, 3, 4, 5) {'a': 6, 'b': 7}
     >>> f(1, 2, 3, x=4, y=5, *(6, 7), **{'a':8, 'b': 9})
diff --git a/Lib/test/test_unpack_ex.py b/Lib/test/test_unpack_ex.py
@@ -248,6 +248,11 @@
       ...
     TypeError: f() got multiple values for keyword argument 'x'
 
+    >>> f(x=5, **{'x': 3}, **{'x': 2})
+    Traceback (most recent call last):
+      ...
+    TypeError: f() got multiple values for keyword argument 'x'
+
     >>> f(**{1: 3}, **{1: 5})
     Traceback (most recent call last):
       ...
diff --git a/Misc/NEWS b/Misc/NEWS
@@ -10,6 +10,10 @@ Release date: tba
 Core and Builtins
 -----------------
 
+- Issue #27286: Fixed compiling BUILD_MAP_UNPACK_WITH_CALL opcode.  Calling
+  function with generalized unpacking (PEP 448) and conflicting keyword names
+  could cause undefined behavior.
+
 - Issue #27066: Fixed SystemError if a custom opener (for open()) returns a
   negative number without setting an exception.
 
diff --git a/PC/launcher.c b/PC/launcher.c
@@ -1081,7 +1081,7 @@ static PYC_MAGIC magic_values[] = {
     { 3160, 3180, L"3.2" },
     { 3190, 3230, L"3.3" },
     { 3250, 3310, L"3.4" },
-    { 3320, 3350, L"3.5" },
+    { 3320, 3351, L"3.5" },
     { 3360, 3361, L"3.6" },
     { 0 }
 };
diff --git a/Python/compile.c b/Python/compile.c
@@ -3262,7 +3262,7 @@ compiler_call_helper(struct compiler *c,
         code |= 2;
         if (nsubkwargs > 1) {
             /* Pack it all up */
-            int function_pos = n + (code & 1) + nkw + 1;
+            int function_pos = n + (code & 1) + 2 * nkw + 1;
             ADDOP_I(c, BUILD_MAP_UNPACK_WITH_CALL, nsubkwargs | (function_pos << 8));
         }
     }
diff --git a/Python/importlib_external.h b/Python/importlib_external.h

Original file line number	Diff line number	Diff line change
`@@ -3262,7 +3262,7 @@ compiler_call_helper(struct compiler *c,`
`3262`	`3262`	`code \|= 2;`
`3263`	`3263`	`if (nsubkwargs > 1) {`
`3264`	`3264`	`/* Pack it all up */`
`3265`		`- int function_pos = n + (code & 1) + nkw + 1;`
	`3265`	`+ int function_pos = n + (code & 1) + 2 * nkw + 1;`
`3266`	`3266`	`ADDOP_I(c, BUILD_MAP_UNPACK_WITH_CALL, nsubkwargs \| (function_pos << 8));`
`3267`	`3267`	`}`
`3268`	`3268`	`}`