diff options
| author | Antoine Pitrou <solipsis@pitrou.net> | 2011-03-17 22:34:33 (GMT) |
|---|---|---|
| committer | Antoine Pitrou <solipsis@pitrou.net> | 2011-03-17 22:34:33 (GMT) |
| commit | bb6eb857cf055079b1108a2afd5a434433c97e90 (patch) | |
| tree | 660da71fb09ff88b8394b89e9546f550dd1e4e0c /Modules | |
| parent | 9befeb3743aaaee6aef036b5a1092cc02d9b4dfa (diff) | |
| download | cpython-bb6eb857cf055079b1108a2afd5a434433c97e90.zip cpython-bb6eb857cf055079b1108a2afd5a434433c97e90.tar.gz cpython-bb6eb857cf055079b1108a2afd5a434433c97e90.tar.bz2 | |
Issue #10914: fix bogus memory management in Modules/getpath.c, leading to a possible crash when calling Py_SetPath()
Diffstat (limited to 'Modules')
| -rw-r--r-- | Modules/getpath.c | 10 |
1 files changed, 7 insertions, 3 deletions
diff --git a/Modules/getpath.c b/Modules/getpath.c index 59623d7..b7f9573 100644 --- a/Modules/getpath.c +++ b/Modules/getpath.c @@ -134,6 +134,7 @@ static wchar_t prefix[MAXPATHLEN+1]; static wchar_t exec_prefix[MAXPATHLEN+1]; static wchar_t progpath[MAXPATHLEN+1]; static wchar_t *module_search_path = NULL; +static int module_search_path_malloced = 0; static wchar_t *lib_python = L"lib/python" VERSION; static void @@ -634,7 +635,6 @@ calculate_path(void) bufsz += wcslen(zip_path) + 1; bufsz += wcslen(exec_prefix) + 1; - /* This is the only malloc call in this file */ buf = (wchar_t *)PyMem_Malloc(bufsz*sizeof(wchar_t)); if (buf == NULL) { @@ -687,6 +687,7 @@ calculate_path(void) /* And publish the results */ module_search_path = buf; + module_search_path_malloced = 1; } /* Reduce prefix and exec_prefix to their essence, @@ -726,15 +727,18 @@ void Py_SetPath(const wchar_t *path) { if (module_search_path != NULL) { - free(module_search_path); + if (module_search_path_malloced) + PyMem_Free(module_search_path); module_search_path = NULL; + module_search_path_malloced = 0; } if (path != NULL) { extern wchar_t *Py_GetProgramName(void); wchar_t *prog = Py_GetProgramName(); wcsncpy(progpath, prog, MAXPATHLEN); exec_prefix[0] = prefix[0] = L'\0'; - module_search_path = malloc((wcslen(path) + 1) * sizeof(wchar_t)); + module_search_path = PyMem_Malloc((wcslen(path) + 1) * sizeof(wchar_t)); + module_search_path_malloced = 1; if (module_search_path != NULL) wcscpy(module_search_path, path); } |