In order to fix SF bug # 824977, we replace calloc()/free() calls in

binascii_a2b_qp() and binascii_b2a_qp() with calls to PyMem_Malloc() and
PyMem_Free().  These won't return NULL unless the allocations actually fail,
so it won't trigger a bogus memory error on some platforms <cough>AIX</cough>
when passed a length of zero.

1 files changed, 16 insertions, 9 deletions

diff --git a/Modules/binascii.c b/Modules/binascii.c
index 05964c9..9cc49f6 100644
--- a/Modules/binascii.c
+++ b/Modules/binascii.c
@@ -1036,13 +1036,16 @@ binascii_a2b_qp(PyObject *self, PyObject *args, PyObject *kwargs)
 	      &datalen, &header))
 		return NULL;
 
-	/* We allocate the output same size as input, this is overkill */
-	odata = (unsigned char *) calloc(1, datalen);
-
+	/* We allocate the output same size as input, this is overkill.
+	 * The previous implementation used calloc() so we'll zero out the
+	 * memory here too, since PyMem_Malloc() does not guarantee that.
+	 */
+	odata = (unsigned char *) PyMem_Malloc(datalen);
 	if (odata == NULL) {
 		PyErr_NoMemory();
 		return NULL;
 	}
+	memset(odata, datalen, 0);
 
 	in = out = 0;
 	while (in < datalen) {
@@ -1090,10 +1093,10 @@ binascii_a2b_qp(PyObject *self, PyObject *args, PyObject *kwargs)
 		}
 	}
 	if ((rv = PyString_FromStringAndSize((char *)odata, out)) == NULL) {
-		free (odata);
+		PyMem_Free(odata);
 		return NULL;
 	}
-	free (odata);
+	PyMem_Free(odata);
 	return rv;
 }
 
@@ -1207,12 +1210,16 @@ binascii_b2a_qp (PyObject *self, PyObject *args, PyObject *kwargs)
 		}
 	}
 
-	odata = (unsigned char *) calloc(1, odatalen);
-
+	/* We allocate the output same size as input, this is overkill.
+	 * The previous implementation used calloc() so we'll zero out the
+	 * memory here too, since PyMem_Malloc() does not guarantee that.
+	 */
+	odata = (unsigned char *) PyMem_Malloc(odatalen);
 	if (odata == NULL) {
 		PyErr_NoMemory();
 		return NULL;
 	}
+	memset(odata, odatalen, 0);
 
 	in = out = linelen = 0;
 	while (in < datalen) {
@@ -1281,10 +1288,10 @@ binascii_b2a_qp (PyObject *self, PyObject *args, PyObject *kwargs)
 		}
 	}
 	if ((rv = PyString_FromStringAndSize((char *)odata, out)) == NULL) {
-		free (odata);
+		PyMem_Free(odata);
 		return NULL;
 	}
-	free (odata);
+	PyMem_Free(odata);
 	return rv;
 }