Issue #29444: Fixed out-of-bounds buffer access in the group() method of

the match object.  Based on patch by WGH.

1 files changed, 2 insertions, 2 deletions

diff --git a/Python/marshal.c b/Python/marshal.c
index 87a4b240a4..d71d3c2b9d 100644
--- a/Python/marshal.c
+++ b/Python/marshal.c
@@ -1274,7 +1274,7 @@ r_object(RFILE *p)
 
         if (n == 0 && type == TYPE_FROZENSET) {
             /* call frozenset() to get the empty frozenset singleton */
-            v = PyObject_CallFunction((PyObject*)&PyFrozenSet_Type, NULL);
+            v = _PyObject_CallNoArg((PyObject*)&PyFrozenSet_Type);
             if (v == NULL)
                 break;
             R_REF(v);
@@ -1649,7 +1649,7 @@ marshal_dump(PyObject *self, PyObject *args)
     s = PyMarshal_WriteObjectToString(x, version);
     if (s == NULL)
         return NULL;
-    res = _PyObject_CallMethodId(f, &PyId_write, "O", s);
+    res = _PyObject_CallMethodIdObjArgs(f, &PyId_write, s, NULL);
     Py_DECREF(s);
     return res;
 }