From 398ef5c08feabfdbf7d0b1e10817139f0e98eefd Mon Sep 17 00:00:00 2001
From: Serhiy Storchaka <storchaka@gmail.com>
Date: Fri, 20 Jan 2017 08:33:06 +0200
Subject: [PATCH] Issue #29327: Fixed a crash when pass the iterable keyword
 argument to sorted().

---
 Lib/test/test_builtin.py | 10 ++++++++++
 Misc/NEWS                |  3 +++
 Python/bltinmodule.c     |  3 ++-
 3 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/Lib/test/test_builtin.py b/Lib/test/test_builtin.py
index a792099f10a..416316c0285 100644
--- a/Lib/test/test_builtin.py
+++ b/Lib/test/test_builtin.py
@@ -1627,6 +1627,16 @@ class TestSorted(unittest.TestCase):
         self.assertEqual(data, sorted(copy, reverse=1))
         self.assertNotEqual(data, copy)
 
+    def test_bad_arguments(self):
+        # Issue #29327: The first argument is positional-only.
+        sorted([])
+        with self.assertRaises(TypeError):
+            sorted(iterable=[])
+        # Other arguments are keyword-only
+        sorted([], key=None)
+        with self.assertRaises(TypeError):
+            sorted([], None)
+
     def test_inputtypes(self):
         s = 'abracadabra'
         types = [list, tuple, str]
diff --git a/Misc/NEWS b/Misc/NEWS
index dfb42b681a4..138539b4187 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -10,6 +10,9 @@ What's New in Python 3.6.1 release candidate 1?
 Core and Builtins
 -----------------
 
+- Issue #29327: Fixed a crash when pass the iterable keyword argument to
+  sorted().
+
 - Issue #29034: Fix memory leak and use-after-free in os module (path_converter).
 
 - Issue #29159: Fix regression in bytes(x) when x.__index__() raises Exception.
diff --git a/Python/bltinmodule.c b/Python/bltinmodule.c
index 69e5f08b0ee..8acdfc3222b 100644
--- a/Python/bltinmodule.c
+++ b/Python/bltinmodule.c
@@ -2123,7 +2123,7 @@ builtin_sorted(PyObject *self, PyObject *args, PyObject *kwds)
 {
     PyObject *newlist, *v, *seq, *keyfunc=NULL, **newargs;
     PyObject *callable;
-    static char *kwlist[] = {"iterable", "key", "reverse", 0};
+    static char *kwlist[] = {"", "key", "reverse", 0};
     int reverse;
     Py_ssize_t nargs;
 
@@ -2142,6 +2142,7 @@ builtin_sorted(PyObject *self, PyObject *args, PyObject *kwds)
         return NULL;
     }
 
+    assert(PyTuple_GET_SIZE(args) >= 1);
     newargs = &PyTuple_GET_ITEM(args, 1);
     nargs = PyTuple_GET_SIZE(args) - 1;
     v = _PyObject_FastCallDict(callable, newargs, nargs, kwds);