gh-110864: Fix _PyArg_UnpackKeywordsWithVararg overwriting vararg with NULL (#110868)

sobolevn · web-flow · commit c2192a2bee17 · 2023-10-16T13:42:44.000+02:00
diff --git a/Lib/test/test_clinic.py b/Lib/test/test_clinic.py
@@ -3154,6 +3154,10 @@ def test_posonly_vararg(self):
         self.assertEqual(ac_tester.posonly_vararg(1, 2), (1, 2, ()))
         self.assertEqual(ac_tester.posonly_vararg(1, b=2), (1, 2, ()))
         self.assertEqual(ac_tester.posonly_vararg(1, 2, 3, 4), (1, 2, (3, 4)))
+        with self.assertRaises(TypeError):
+            ac_tester.posonly_vararg(b=4)
+        with self.assertRaises(TypeError):
+            ac_tester.posonly_vararg(1, 2, 3, b=4)
 
     def test_vararg_and_posonly(self):
         with self.assertRaises(TypeError):
@@ -3204,6 +3208,37 @@ def test_gh_99240_double_free(self):
         with self.assertRaisesRegex(TypeError, err):
             ac_tester.gh_99240_double_free('a', '\0b')
 
+    def test_null_or_tuple_for_varargs(self):
+        # All of these should not crash:
+        valid_args_for_test = [
+            (('a',), {},
+             ('a', (), False)),
+            (('a', 1, 2, 3), {'covariant': True},
+             ('a', (1, 2, 3), True)),
+            ((), {'name': 'a'},
+             ('a', (), False)),
+            ((), {'name': 'a', 'covariant': True},
+             ('a', (), True)),
+            ((), {'covariant': True, 'name': 'a'},
+             ('a', (), True)),
+        ]
+        for args, kwargs, expected in valid_args_for_test:
+            with self.subTest(args=args, kwargs=kwargs):
+                self.assertEqual(
+                    ac_tester.null_or_tuple_for_varargs(*args, **kwargs),
+                    expected,
+                )
+
+    def test_null_or_tuple_for_varargs_error(self):
+        with self.assertRaises(TypeError):
+            ac_tester.null_or_tuple_for_varargs(covariant=True)
+        with self.assertRaises(TypeError):
+            ac_tester.null_or_tuple_for_varargs(1, name='a')
+        with self.assertRaises(TypeError):
+            ac_tester.null_or_tuple_for_varargs(1, 2, 3, name='a', covariant=True)
+        with self.assertRaises(TypeError):
+            ac_tester.null_or_tuple_for_varargs(1, 2, 3, covariant=True, name='a')
+
     def test_cloned_func_exception_message(self):
         incorrect_arg = -1  # f1() and f2() accept a single str
         with self.assertRaisesRegex(TypeError, "clone_f1"):
diff --git a/Misc/NEWS.d/next/Core and Builtins/2023-10-14-12-19-34.gh-issue-110864.-baPDE.rst b/Misc/NEWS.d/next/Core and Builtins/2023-10-14-12-19-34.gh-issue-110864.-baPDE.rst
@@ -0,0 +1,2 @@
+Fix argument parsing by ``_PyArg_UnpackKeywordsWithVararg`` for functions
+defining pos-or-keyword, vararg, and kw-only parameters.
diff --git a/Modules/_testclinic.c b/Modules/_testclinic.c
@@ -1128,6 +1128,26 @@ gh_99240_double_free_impl(PyObject *module, char *a, char *b)
     Py_RETURN_NONE;
 }
 
+/*[clinic input]
+null_or_tuple_for_varargs
+
+    name: object
+    *constraints: object
+    covariant: bool = False
+
+See https://github.com/python/cpython/issues/110864
+[clinic start generated code]*/
+
+static PyObject *
+null_or_tuple_for_varargs_impl(PyObject *module, PyObject *name,
+                               PyObject *constraints, int covariant)
+/*[clinic end generated code: output=a785b35421358983 input=c9bce186637956b3]*/
+{
+    assert(name != NULL);
+    assert(constraints != NULL);
+    PyObject *c = covariant ? Py_True : Py_False;
+    return pack_arguments_newref(3, name, constraints, c);
+}
 
 /*[clinic input]
 _testclinic.clone_f1 as clone_f1
@@ -1843,6 +1863,7 @@ static PyMethodDef tester_methods[] = {
     GH_32092_KW_PASS_METHODDEF
     GH_99233_REFCOUNT_METHODDEF
     GH_99240_DOUBLE_FREE_METHODDEF
+    NULL_OR_TUPLE_FOR_VARARGS_METHODDEF
     CLONE_F1_METHODDEF
     CLONE_F2_METHODDEF
     CLONE_WITH_CONV_F1_METHODDEF
diff --git a/Modules/clinic/_testclinic.c.h b/Modules/clinic/_testclinic.c.h
diff --git a/Python/getargs.c b/Python/getargs.c
@@ -2522,7 +2522,7 @@ _PyArg_UnpackKeywordsWithVararg(PyObject *const *args, Py_ssize_t nargs,
          *
          * Otherwise, we leave a place at `buf[vararg]` for vararg tuple
          * so the index is `i + 1`. */
-        if (nargs < vararg) {
+        if (nargs < vararg && i != vararg) {
             buf[i] = current_arg;
         }
         else {

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	+Fix argument parsing by ``_PyArg_UnpackKeywordsWithVararg`` for functions
	`2`	`+defining pos-or-keyword, vararg, and kw-only parameters.`
Original file line number	Diff line number	Diff line change
`@@ -2522,7 +2522,7 @@ _PyArg_UnpackKeywordsWithVararg(PyObject const args, Py_ssize_t nargs,`
`2522`	`2522`	`*`
`2523`	`2523`	* Otherwise, we leave a place at `buf[vararg]` for vararg tuple
`2524`	`2524`	* so the index is `i + 1`. */
`2525`		`- if (nargs < vararg) {`
	`2525`	`+ if (nargs < vararg && i != vararg) {`
`2526`	`2526`	`buf[i] = current_arg;`
`2527`	`2527`	`}`
`2528`	`2528`	`else {`