Additional safe-guard against dereferencing NULL in reduce_newobj

_PyObject_GetNewArguments() can leave args == NULL but the __newobj_ex__
branch expects args to be not-NULL.

CID 1353201

diff --git a/Objects/typeobject.c b/Objects/typeobject.c
index 209d4fab1f650c479b17fefc25baa32c0023cead..ae593636e6c623e55ea41d74a5801c9c2a878f00 100644 (file)
--- a/Objects/typeobject.c
+++ b/Objects/typeobject.c
@@ -4263,7 +4263,7 @@ reduce_newobj(PyObject *obj)
         }
         Py_XDECREF(args);
     }
-    else {
+    else if (args != NULL) {
         _Py_IDENTIFIER(__newobj_ex__);
 
         newobj = _PyObject_GetAttrId(copyreg, &PyId___newobj_ex__);
@@ -4281,6 +4281,12 @@ reduce_newobj(PyObject *obj)
             return NULL;
         }
     }
+    else {
+        /* args == NULL */
+        Py_DECREF(kwargs);
+        PyErr_BadInternalCall();
+        return NULL;
+    }
 
     state = _PyObject_GetState(obj,
                 !hasargs && !PyList_Check(obj) && !PyDict_Check(obj));