bpo-37138: fix undefined behaviour with memcpy() on NULL array (GH-13867)

jdemeyer · gpshead · commit 1f9531764cc0 · 2019-06-07T11:01:53.000-07:00
diff --git a/Objects/classobject.c b/Objects/classobject.c
@@ -71,7 +71,11 @@ method_vectorcall(PyObject *method, PyObject *const *args,
         }
         /* use borrowed references */
         newargs[0] = self;
-        memcpy(newargs + 1, args, totalargs * sizeof(PyObject *));
+        if (totalargs) { /* bpo-37138: if totalargs == 0, then args may be
+                          * NULL and calling memcpy() with a NULL pointer
+                          * is undefined behaviour. */
+            memcpy(newargs + 1, args, totalargs * sizeof(PyObject *));
+        }
         result = _PyObject_Vectorcall(func, newargs, nargs+1, kwnames);
         PyMem_Free(newargs);
     }

Original file line number	Diff line number	Diff line change
`@@ -71,7 +71,11 @@ method_vectorcall(PyObject method, PyObject const *args,`
`71`	`71`	`}`
`72`	`72`	`/* use borrowed references */`
`73`	`73`	`newargs[0] = self;`
`74`		`- memcpy(newargs + 1, args, totalargs * sizeof(PyObject *));`
	`74`	`+ if (totalargs) { /* bpo-37138: if totalargs == 0, then args may be`
	`75`	`+ * NULL and calling memcpy() with a NULL pointer`
	`76`	`+ * is undefined behaviour. */`
	`77`	`+ memcpy(newargs + 1, args, totalargs * sizeof(PyObject *));`
	`78`	`+ }`
`75`	`79`	`result = _PyObject_Vectorcall(func, newargs, nargs+1, kwnames);`
`76`	`80`	`PyMem_Free(newargs);`
`77`	`81`	`}`