Issue #29444: Fixed out-of-bounds buffer access in the group() method of

the match object.  Based on patch by WGH.

1 files changed, 6 insertions, 9 deletions

diff --git a/Modules/_sqlite/connection.c b/Modules/_sqlite/connection.c
index 1c6aa54c22..37b45f330b 100644
--- a/Modules/_sqlite/connection.c
+++ b/Modules/_sqlite/connection.c
@@ -400,8 +400,7 @@ error:
     if (PyErr_Occurred()) {
         return NULL;
     } else {
-        Py_INCREF(Py_None);
-        return Py_None;
+        Py_RETURN_NONE;
     }
 }
 
@@ -443,8 +442,7 @@ error:
     if (PyErr_Occurred()) {
         return NULL;
     } else {
-        Py_INCREF(Py_None);
-        return Py_None;
+        Py_RETURN_NONE;
     }
 }
 
@@ -487,8 +485,7 @@ error:
     if (PyErr_Occurred()) {
         return NULL;
     } else {
-        Py_INCREF(Py_None);
-        return Py_None;
+        Py_RETURN_NONE;
     }
 }
 
@@ -645,7 +642,7 @@ static void _pysqlite_step_callback(sqlite3_context *context, int argc, sqlite3_
     aggregate_instance = (PyObject**)sqlite3_aggregate_context(context, sizeof(PyObject*));
 
     if (*aggregate_instance == 0) {
-        *aggregate_instance = PyObject_CallFunction(aggregate_class, NULL);
+        *aggregate_instance = _PyObject_CallNoArg(aggregate_class);
 
         if (PyErr_Occurred()) {
             *aggregate_instance = 0;
@@ -933,7 +930,7 @@ static int _progress_handler(void* user_arg)
 
     gilstate = PyGILState_Ensure();
 #endif
-    ret = PyObject_CallFunction((PyObject*)user_arg, NULL);
+    ret = _PyObject_CallNoArg((PyObject*)user_arg);
 
     if (!ret) {
         if (_enable_callback_tracebacks) {
@@ -1489,7 +1486,7 @@ pysqlite_connection_create_collation(pysqlite_Connection* self, PyObject* args)
     PyObject* retval;
     Py_ssize_t i, len;
     _Py_IDENTIFIER(upper);
-    char *uppercase_name_str;
+    const char *uppercase_name_str;
     int rc;
     unsigned int kind;
     void *data;