commit a4d78362397fc3bced6ea80fbc7b5f4827aec55e
author Brad Larsen <brad@bradfordlarsen.com> Mon Apr 01 10:36:05 2019 -0400
committer Guido van Rossum <guido@python.org> Mon Apr 01 07:36:05 2019 -0700
tree 48884a58dc472e2ca0d447af4028461f6124c104
parent 10654c19b5e6efdf3c529ff9bf7bcab89bdca1c1

bpo-36495: Fix two out-of-bounds array reads (GH-12641)

Research and fix by @bradlarsen.

Python/ast.c

diff --git a/Python/ast.c b/Python/ast.c
index e9154fe..913e53a 100644
--- a/Python/ast.c
+++ b/Python/ast.c
@@ -1400,7 +1400,7 @@
                     goto error;
                 asdl_seq_SET(kwonlyargs, j++, arg);
                 i += 1; /* the name */
-                if (TYPE(CHILD(n, i)) == COMMA)
+                if (i < NCH(n) && TYPE(CHILD(n, i)) == COMMA)
                     i += 1; /* the comma, if present */
                 break;
             case TYPE_COMMENT:
@@ -1599,7 +1599,7 @@
                 if (!kwarg)
                     return NULL;
                 i += 2; /* the double star and the name */
-                if (TYPE(CHILD(n, i)) == COMMA)
+                if (i < NCH(n) && TYPE(CHILD(n, i)) == COMMA)
                     i += 1; /* the comma, if present */
                 break;
             case TYPE_COMMENT: