Issue 5794: fix cPickle's unpickling of recursive tuples.

1 files changed, 9 insertions, 10 deletions

diff --git a/Modules/cPickle.c b/Modules/cPickle.c
index fbb1888aaa..486e86fc12 100644
--- a/Modules/cPickle.c
+++ b/Modules/cPickle.c
@@ -4086,25 +4086,24 @@ load_binpersid(Unpicklerobject *self)
 static int
 load_pop(Unpicklerobject *self)
 {
-	int len;
-
-	if (!( (len=self->stack->length) > 0 ))  return stackUnderflow();
+	int len = self->stack->length;
 
 	/* Note that we split the (pickle.py) stack into two stacks,
 	   an object stack and a mark stack. We have to be clever and
 	   pop the right one. We do this by looking at the top of the
-	   mark stack.
+	   mark stack first, and only signalling a stack underflow if
+	   the object stack is empty and the mark stack doesn't match
+	   our expectations.
 	*/
-
-	if ((self->num_marks > 0) &&
-	    (self->marks[self->num_marks - 1] == len))
+	if (self->num_marks > 0 && self->marks[self->num_marks - 1] == len) {
 		self->num_marks--;
-	else {
+	} else if (len >= 0) {
 		len--;
 		Py_DECREF(self->stack->data[len]);
-		self->stack->length=len;
+		self->stack->length = len;
+	} else {
+		return stackUnderflow();
 	}
-
 	return 0;
 }