Issue #24683: Fixed crashes in _json functions called with arguments of

inappropriate type.

3 files changed, 19 insertions, 2 deletions

diff --git a/Lib/test/test_json/test_separators.py b/Lib/test/test_json/test_separators.py
index 84a2be9ae0..8ca5174051 100644
--- a/Lib/test/test_json/test_separators.py
+++ b/Lib/test/test_json/test_separators.py
@@ -39,6 +39,12 @@ class TestSeparators:
         self.assertEqual(h2, h)
         self.assertEqual(d2, expect)
 
+    def test_illegal_separators(self):
+        h = {1: 2, 3: 4}
+        self.assertRaises(TypeError, self.dumps, h, separators=(b', ', ': '))
+        self.assertRaises(TypeError, self.dumps, h, separators=(', ', b': '))
+        self.assertRaises(TypeError, self.dumps, h, separators=(b', ', b': '))
+
 
 class TestPySeparators(TestSeparators, PyTest): pass
 class TestCSeparators(TestSeparators, CTest): pass
diff --git a/Misc/NEWS b/Misc/NEWS
index b270ebf1b4..b72fe97fd6 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -28,6 +28,9 @@ Core and Builtins
 Library
 -------
 
+- Issue #24683: Fixed crashes in _json functions called with arguments of
+  inappropriate type.
+
 - Issue #21697: shutil.copytree() now correctly handles symbolic links that
   point to directories.  Patch by Eduardo Seabra and Thomas Kluyver.
 
diff --git a/Modules/_json.c b/Modules/_json.c
index 8000f915f3..f63d758348 100644
--- a/Modules/_json.c
+++ b/Modules/_json.c
@@ -1344,11 +1344,19 @@ encoder_init(PyObject *self, PyObject *args, PyObject *kwds)
     assert(PyEncoder_Check(self));
     s = (PyEncoderObject *)self;
 
-    if (!PyArg_ParseTupleAndKeywords(args, kwds, "OOOOOOOOp:make_encoder", kwlist,
-        &markers, &defaultfn, &encoder, &indent, &key_separator, &item_separator,
+    if (!PyArg_ParseTupleAndKeywords(args, kwds, "OOOOUUOOp:make_encoder", kwlist,
+        &markers, &defaultfn, &encoder, &indent,
+        &key_separator, &item_separator,
         &sort_keys, &skipkeys, &allow_nan))
         return -1;
 
+    if (markers != Py_None && !PyDict_Check(markers)) {
+        PyErr_Format(PyExc_TypeError,
+                     "make_encoder() argument 1 must be dict or None, "
+                     "not %.200s", Py_TYPE(markers)->tp_name);
+        return -1;
+    }
+
     s->markers = markers;
     s->defaultfn = defaultfn;
     s->encoder = encoder;