gh-118814: Fix crash in _PyArg_UnpackKeywordsWithVararg

Include/internal/pycore_global_strings.h

@@ -290,6 +290,9 @@ struct _Py_global_strings {
         STRUCT_FOR_ID(attribute)
         STRUCT_FOR_ID(authorizer_callback)
         STRUCT_FOR_ID(autocommit)
+        STRUCT_FOR_ID(b1)
+        STRUCT_FOR_ID(b2)
+        STRUCT_FOR_ID(b3)
         STRUCT_FOR_ID(backtick)
         STRUCT_FOR_ID(base)
         STRUCT_FOR_ID(before)

Lib/test/test_clinic.py

@@ -3339,6 +3339,18 @@ def test_vararg_with_default(self):
         self.assertEqual(ac_tester.vararg_with_default(1, b=False), (1, (), False))
         self.assertEqual(ac_tester.vararg_with_default(1, 2, 3, 4), (1, (2, 3, 4), False))
         self.assertEqual(ac_tester.vararg_with_default(1, 2, 3, 4, b=True), (1, (2, 3, 4), True))
+        self.assertEqual(ac_tester.vararg_with_default(a=1, b=False), (1, (), False))
+        self.assertEqual(ac_tester.vararg_with_default(b=False, a=1), (1, (), False))
+
+    def test_vararg_with_multiple_defaults(self):
+        func = ac_tester.vararg_with_multiple_defaults
+        with self.assertRaises(TypeError):
+            func()
+        self.assertEqual(func(1, b1=True), (1, (), True, False, False))
+        self.assertEqual(func(1, 2, 3, 4), (1, (2, 3, 4), False, False, False))
+        self.assertEqual(func(1, 2, 3, 4, b1=True), (1, (2, 3, 4), True, False, False))
+        self.assertEqual(func(a=1, b1=True), (1, (), True, False, False))
+        self.assertEqual(func(b1=True, a=1), (1, (), True, False, False))
 
     def test_vararg_with_only_defaults(self):
         self.assertEqual(ac_tester.vararg_with_only_defaults(), ((), None))

Misc/NEWS.d/next/Core and Builtins/2024-08-01-14-04-18.gh-issue-118814.m3pHDY.rst

@@ -0,0 +1,3 @@
+Fix argument parsing by ``_PyArg_UnpackKeywordsWithVararg`` when passing
+positional as keyword arguments before variadic arguments. Patch by Bénédikt
+Tran.

Modules/_testclinic.c

@@ -1033,6 +1033,29 @@ vararg_with_default_impl(PyObject *module, PyObject *a, PyObject *args,
 }
 
 
+/*[clinic input]
+vararg_with_multiple_defaults
+
+    a: object
+    *args: object
+    b1: bool = False
+    b2: bool = False
+    b3: bool = False
+
+[clinic start generated code]*/
+
+static PyObject *
+vararg_with_multiple_defaults_impl(PyObject *module, PyObject *a,
+                                   PyObject *args, int b1, int b2, int b3)
+/*[clinic end generated code: output=66087a6689e6bee5 input=66e4b2858ad13769]*/
+{
+    PyObject *obj_b1 = b1 ? Py_True : Py_False;
+    PyObject *obj_b2 = b2 ? Py_True : Py_False;
+    PyObject *obj_b3 = b3 ? Py_True : Py_False;
+    return pack_arguments_newref(5, a, args, obj_b1, obj_b2, obj_b3);
+}
+
+
 /*[clinic input]
 vararg_with_only_defaults
 
@@ -1907,6 +1930,7 @@ static PyMethodDef tester_methods[] = {
     VARARG_AND_POSONLY_METHODDEF
     VARARG_METHODDEF
     VARARG_WITH_DEFAULT_METHODDEF
+    VARARG_WITH_MULTIPLE_DEFAULTS_METHODDEF
     VARARG_WITH_ONLY_DEFAULTS_METHODDEF
     GH_32092_OOB_METHODDEF
     GH_32092_KW_PASS_METHODDEF

Python/getargs.c

@@ -2589,7 +2589,13 @@ _PyArg_UnpackKeywordsWithVararg(PyObject *const *args, Py_ssize_t nargs,
          * Otherwise, we leave a place at `buf[vararg]` for vararg tuple
          * so the index is `i + 1`. */
         if (nargs < vararg && i != vararg) {
-            buf[i] = current_arg;
+            if (current_arg != NULL) {
+                // It might happen that in the previous iteration,
+                // we did "buf[i + 1] = current_arg" and that in
+                // this current loop iteration, current_arg == NULL.
+                // We do not want to put a NULL on a previously valid value.
+                buf[i] = current_arg;
+            }
         }
         else {
             buf[i + 1] = current_arg;