bpo-36290: Fix keytword collision handling in AST node constructors (GH-12382)

(cherry picked from commit c73914a562580ae72048876cb42ed8e76e2c83f9)

Co-authored-by: Rémi Lapeyre <remi.lapeyre@lenstra.fr>

1 files changed, 24 insertions, 3 deletions

diff --git a/Python/Python-ast.c b/Python/Python-ast.c
index f34b1450c6..d2edf74c81 100644
--- a/Python/Python-ast.c
+++ b/Python/Python-ast.c
@@ -1131,8 +1131,9 @@ ast_type_init(PyObject *self, PyObject *args, PyObject *kw)
     }
     if (fields) {
         numfields = PySequence_Size(fields);
-        if (numfields == -1)
+        if (numfields == -1) {
             goto cleanup;
+        }
     }
 
     res = 0; /* if no error occurs, this stays 0 to the end */
@@ -1153,15 +1154,35 @@ ast_type_init(PyObject *self, PyObject *args, PyObject *kw)
         }
         res = PyObject_SetAttr(self, name, PyTuple_GET_ITEM(args, i));
         Py_DECREF(name);
-        if (res < 0)
+        if (res < 0) {
             goto cleanup;
+        }
     }
     if (kw) {
         i = 0;  /* needed by PyDict_Next */
         while (PyDict_Next(kw, &i, &key, &value)) {
+            int contains = PySequence_Contains(fields, key);
+            if (contains == -1) {
+                res = -1;
+                goto cleanup;
+            } else if (contains == 1) {
+                Py_ssize_t p = PySequence_Index(fields, key);
+                if (p == -1) {
+                    res = -1;
+                    goto cleanup;
+                }
+                if (p < PyTuple_GET_SIZE(args)) {
+                    PyErr_Format(PyExc_TypeError,
+                        "%.400s got multiple values for argument '%U'",
+                        Py_TYPE(self)->tp_name, key);
+                    res = -1;
+                    goto cleanup;
+                }
+            }
             res = PyObject_SetAttr(self, key, value);
-            if (res < 0)
+            if (res < 0) {
                 goto cleanup;
+            }
         }
     }
   cleanup: