diff options
| author | Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com> | 2018-08-25 19:11:29 (GMT) |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2018-08-25 19:11:29 (GMT) |
| commit | 15dadacabf6a1c62e9920b6a42ff8936ea1830f8 (patch) | |
| tree | c3cbd6af7b335016b01aaed28fdc74fad757144e /Objects/typeobject.c | |
| parent | 42a1ca65d00ba59fe63cc65df0ff297a885e61b8 (diff) | |
| download | cpython-15dadacabf6a1c62e9920b6a42ff8936ea1830f8.zip cpython-15dadacabf6a1c62e9920b6a42ff8936ea1830f8.tar.gz cpython-15dadacabf6a1c62e9920b6a42ff8936ea1830f8.tar.bz2 | |
closes bpo-34501: PyType_FromSpecWithBases: Check spec->name before dereferencing it. (GH-8930)
Reported by Svace static analyzer.
(cherry picked from commit 5f79b50763d687aeeed8edcb4efcc7ac9f8fa186)
Co-authored-by: Alexey Izbyshev <izbyshev@ispras.ru>
Diffstat (limited to 'Objects/typeobject.c')
| -rw-r--r-- | Objects/typeobject.c | 13 |
1 files changed, 9 insertions, 4 deletions
diff --git a/Objects/typeobject.c b/Objects/typeobject.c index af9685d..52fcfeb 100644 --- a/Objects/typeobject.c +++ b/Objects/typeobject.c @@ -2847,6 +2847,15 @@ PyType_FromSpecWithBases(PyType_Spec *spec, PyObject *bases) char *res_start = (char*)res; PyType_Slot *slot; + if (res == NULL) + return NULL; + + if (spec->name == NULL) { + PyErr_SetString(PyExc_SystemError, + "Type spec does not define the name field."); + goto fail; + } + /* Set the type name and qualname */ s = strrchr(spec->name, '.'); if (s == NULL) @@ -2854,8 +2863,6 @@ PyType_FromSpecWithBases(PyType_Spec *spec, PyObject *bases) else s++; - if (res == NULL) - return NULL; type = &res->ht_type; /* The flags must be initialized early, before the GC traverses us */ type->tp_flags = spec->flags | Py_TPFLAGS_HEAPTYPE; @@ -2865,8 +2872,6 @@ PyType_FromSpecWithBases(PyType_Spec *spec, PyObject *bases) res->ht_qualname = res->ht_name; Py_INCREF(res->ht_qualname); type->tp_name = spec->name; - if (!type->tp_name) - goto fail; /* Adjust for empty tuple bases */ if (!bases) { |