diff options
| author | Antoine Pitrou <solipsis@pitrou.net> | 2012-11-17 22:28:17 (GMT) |
|---|---|---|
| committer | Antoine Pitrou <solipsis@pitrou.net> | 2012-11-17 22:28:17 (GMT) |
| commit | 6d5ad227a50c6c5a78e48a98095788953ab49512 (patch) | |
| tree | 9890bd98fc7c2069fcea429811e4c42f6590508a /Objects | |
| parent | fa7aeecbca8265b81749c0c7c85704070c8eeefe (diff) | |
| download | cpython-6d5ad227a50c6c5a78e48a98095788953ab49512.zip cpython-6d5ad227a50c6c5a78e48a98095788953ab49512.tar.gz cpython-6d5ad227a50c6c5a78e48a98095788953ab49512.tar.bz2 | |
Issue #16215: Fix potential double memory free in str.replace().
Patch by Serhiy Storchaka.
Diffstat (limited to 'Objects')
| -rw-r--r-- | Objects/unicodeobject.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/Objects/unicodeobject.c b/Objects/unicodeobject.c index 665f03d..b9ac834 100644 --- a/Objects/unicodeobject.c +++ b/Objects/unicodeobject.c @@ -10118,6 +10118,7 @@ replace(PyObject *self, PyObject *str1, /* widen self and buf1 */ rkind = kind2; if (release1) PyMem_Free(buf1); + release1 = 0; sbuf = _PyUnicode_AsKind(self, rkind); if (!sbuf) goto error; srelease = 1; @@ -10179,6 +10180,7 @@ replace(PyObject *self, PyObject *str1, if (!sbuf) goto error; srelease = 1; if (release1) PyMem_Free(buf1); + release1 = 0; buf1 = _PyUnicode_AsKind(str1, rkind); if (!buf1) goto error; release1 = 1; |