diff options
| author | Pablo Galindo <Pablogsal@gmail.com> | 2018-11-15 02:03:57 (GMT) |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2018-11-15 02:03:57 (GMT) |
| commit | bfb855bef6b428d639693caaf4e4c84cbb8a2f51 (patch) | |
| tree | f24e432640c58a24fba2b4cebc09aac447d9e4e7 /Objects | |
| parent | 4c596d54aa6a55e9d2a3db78891e656ebbfb63c8 (diff) | |
| download | cpython-bfb855bef6b428d639693caaf4e4c84cbb8a2f51.zip cpython-bfb855bef6b428d639693caaf4e4c84cbb8a2f51.tar.gz cpython-bfb855bef6b428d639693caaf4e4c84cbb8a2f51.tar.bz2 | |
bpo-34784: Implement correct cleanup in PyStructSequence new implementation (GH-10536)
PyTuple_Pack can fail and return NULL. If this happens, then PyType_FromSpecWithBases will incorrectly create a new type without bases. Also, it will crash on the Py_DECREF that follows. Also free members and type in error conditions.
Diffstat (limited to 'Objects')
| -rw-r--r-- | Objects/structseq.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/Objects/structseq.c b/Objects/structseq.c index d513710..05ea87b 100644 --- a/Objects/structseq.c +++ b/Objects/structseq.c @@ -447,6 +447,10 @@ PyStructSequence_NewType(PyStructSequence_Desc *desc) spec.slots = slots; bases = PyTuple_Pack(1, &PyTuple_Type); + if (bases == NULL) { + PyMem_FREE(members); + return NULL; + } type = (PyTypeObject *)PyType_FromSpecWithBases(&spec, bases); Py_DECREF(bases); PyMem_FREE(members); @@ -456,6 +460,7 @@ PyStructSequence_NewType(PyStructSequence_Desc *desc) if (initialize_structseq_dict( desc, type->tp_dict, n_members, n_unnamed_members) < 0) { + Py_DECREF(type); return NULL; } |