diff options
| author | Tim Peters <tim.peters@gmail.com> | 2005-07-17 23:45:23 (GMT) |
|---|---|---|
| committer | Tim Peters <tim.peters@gmail.com> | 2005-07-17 23:45:23 (GMT) |
| commit | de7990b8af50e7f2ebf6776b948fdb48408ccb02 (patch) | |
| tree | 36c3ac459cc1140d9e65d8420815fd6468d50ad8 | |
| parent | f5f32b47128763a1f782782bd5a1a125b6d8b28b (diff) | |
| download | cpython-de7990b8af50e7f2ebf6776b948fdb48408ccb02.zip cpython-de7990b8af50e7f2ebf6776b948fdb48408ccb02.tar.gz cpython-de7990b8af50e7f2ebf6776b948fdb48408ccb02.tar.bz2 | |
SF bug #1238681: freed pointer is used in longobject.c:long_pow().
In addition, long_pow() skipped a necessary (albeit extremely unlikely
to trigger) error check when converting an int modulus to long.
Alas, I was unable to write a test case that crashed due to either
cause.
Bugfix candidate.
| -rw-r--r-- | Misc/NEWS | 2 | ||||
| -rw-r--r-- | Objects/longobject.c | 13 |
2 files changed, 10 insertions, 5 deletions
@@ -12,6 +12,8 @@ What's New in Python 2.5 alpha 1? Core and builtins ----------------- +- SF bug #1238681: freed pointer is used in longobject.c:long_pow(). + - SF bug #1229429: PyObject_CallMethod failed to decrement some reference counts in some error exit cases. diff --git a/Objects/longobject.c b/Objects/longobject.c index 1f328dd3..ff5ba6f 100644 --- a/Objects/longobject.c +++ b/Objects/longobject.c @@ -2360,8 +2360,11 @@ long_pow(PyObject *v, PyObject *w, PyObject *x) c = (PyLongObject *)x; Py_INCREF(x); } - else if (PyInt_Check(x)) + else if (PyInt_Check(x)) { c = (PyLongObject *)PyLong_FromLong(PyInt_AS_LONG(x)); + if (c == NULL) + goto Error; + } else if (x == Py_None) c = NULL; else { @@ -2511,14 +2514,14 @@ long_pow(PyObject *v, PyObject *w, PyObject *x) } /* fall through */ Done: - Py_XDECREF(a); - Py_XDECREF(b); - Py_XDECREF(c); - Py_XDECREF(temp); if (b->ob_size > FIVEARY_CUTOFF) { for (i = 0; i < 32; ++i) Py_XDECREF(table[i]); } + Py_DECREF(a); + Py_DECREF(b); + Py_XDECREF(c); + Py_XDECREF(temp); return (PyObject *)z; } |