From acd61b6e4092b316069a526930d8b3d43c1a14df Mon Sep 17 00:00:00 2001
From: Raymond Hettinger <python@rcn.com>
Date: Tue, 28 Jul 2015 02:05:44 -0700
Subject: [PATCH] Issue #24735: Fix invalid memory access in
 combinations_with_replacement()

---
 Misc/NEWS                 |  3 +++
 Modules/itertoolsmodule.c | 12 +++++++-----
 2 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/Misc/NEWS b/Misc/NEWS
index 9bacb3ab03e..c2b6fd17a59 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -69,6 +69,9 @@ Library
 - Issue #23441: rcompleter now prints a tab character instead of displaying
   possible completions for an empty word.  Initial patch by Martin Sekera.
 
+- Issue #24735: Fix invalid memory access in
+  itertools.combinations_with_replacement().
+
 - Issue #17527: Add PATCH to wsgiref.validator. Patch from Luca Sbardella.
 
 - Issue #24683: Fixed crashes in _json functions called with arguments of
diff --git a/Modules/itertoolsmodule.c b/Modules/itertoolsmodule.c
index 6634a1799f4..f5fa3fb3bb3 100644
--- a/Modules/itertoolsmodule.c
+++ b/Modules/itertoolsmodule.c
@@ -2787,11 +2787,13 @@ cwr_next(cwrobject *co)
         if (result == NULL)
             goto empty;
         co->result = result;
-        elem = PyTuple_GET_ITEM(pool, 0);
-        for (i=0; i<r ; i++) {
-            assert(indices[i] == 0);
-            Py_INCREF(elem);
-            PyTuple_SET_ITEM(result, i, elem);
+        if (n > 0) {
+            elem = PyTuple_GET_ITEM(pool, 0);
+            for (i=0; i<r ; i++) {
+                assert(indices[i] == 0);
+                Py_INCREF(elem);
+                PyTuple_SET_ITEM(result, i, elem);
+            }
         }
     } else {
         /* Copy the previous result tuple or re-use it if available */