bpo-34987: Fix a possible null pointer dereference in _pickle.c's save_reduce(). (GH-9886)

miss-islington · ZackerySpytz · web-flow · commit e2f376f284b7 · 2018-12-05T11:35:41.000-08:00
(cherry picked from commit 25d3897) Co-authored-by: Zackery Spytz <zspytz@gmail.com>
diff --git a/Modules/_pickle.c b/Modules/_pickle.c
@@ -3838,7 +3838,10 @@ save_reduce(PicklerObject *self, PyObject *args, PyObject *obj)
 
         if (obj != NULL) {
             obj_class = get_class(obj);
-            p = obj_class != cls;    /* true iff a problem */
+            if (obj_class == NULL) {
+                return -1;
+            }
+            p = obj_class != cls;
             Py_DECREF(obj_class);
             if (p) {
                 PyErr_SetString(st->PicklingError, "args[0] from "
