bpo-36290: Fix keytword collision handling in AST node constructors (GH-12382)

(cherry picked from commit c73914a562580ae72048876cb42ed8e76e2c83f9)

Co-authored-by: Rémi Lapeyre <remi.lapeyre@lenstra.fr>

1 files changed, 24 insertions, 3 deletions

diff --git a/Parser/asdl_c.py b/Parser/asdl_c.py
index 6d572755e68..f8729cd170b 100755
--- a/Parser/asdl_c.py
+++ b/Parser/asdl_c.py
@@ -695,8 +695,9 @@ ast_type_init(PyObject *self, PyObject *args, PyObject *kw)
     }
     if (fields) {
         numfields = PySequence_Size(fields);
-        if (numfields == -1)
+        if (numfields == -1) {
             goto cleanup;
+        }
     }
 
     res = 0; /* if no error occurs, this stays 0 to the end */
@@ -717,15 +718,35 @@ ast_type_init(PyObject *self, PyObject *args, PyObject *kw)
         }
         res = PyObject_SetAttr(self, name, PyTuple_GET_ITEM(args, i));
         Py_DECREF(name);
-        if (res < 0)
+        if (res < 0) {
             goto cleanup;
+        }
     }
     if (kw) {
         i = 0;  /* needed by PyDict_Next */
         while (PyDict_Next(kw, &i, &key, &value)) {
+            int contains = PySequence_Contains(fields, key);
+            if (contains == -1) {
+                res = -1;
+                goto cleanup;
+            } else if (contains == 1) {
+                Py_ssize_t p = PySequence_Index(fields, key);
+                if (p == -1) {
+                    res = -1;
+                    goto cleanup;
+                }
+                if (p < PyTuple_GET_SIZE(args)) {
+                    PyErr_Format(PyExc_TypeError,
+                        "%.400s got multiple values for argument '%U'",
+                        Py_TYPE(self)->tp_name, key);
+                    res = -1;
+                    goto cleanup;
+                }
+            }
             res = PyObject_SetAttr(self, key, value);
-            if (res < 0)
+            if (res < 0) {
                 goto cleanup;
+            }
         }
     }
   cleanup: