diff options
| author | Zackery Spytz <zspytz@gmail.com> | 2019-05-09 18:33:32 (GMT) |
|---|---|---|
| committer | Petr Viktorin <pviktori@redhat.com> | 2019-05-09 18:33:31 (GMT) |
| commit | 0613c1e481440aa8f54ba7f6056924c175fbcc13 (patch) | |
| tree | 7c58edbe03482e817e3e26dd3294b472f88463ad /Objects | |
| parent | e6576248e5174ca5daa362cfd610c07e7eb3a2ae (diff) | |
| download | cpython-0613c1e481440aa8f54ba7f6056924c175fbcc13.zip cpython-0613c1e481440aa8f54ba7f6056924c175fbcc13.tar.gz cpython-0613c1e481440aa8f54ba7f6056924c175fbcc13.tar.bz2 | |
Fix a possible crash due to PyType_FromSpecWithBases() (GH-10304)
If the PyObject_MALLOC() call failed in PyType_FromSpecWithBases(),
PyObject_Free() would be called on a static string in type_dealloc().
Diffstat (limited to 'Objects')
| -rw-r--r-- | Objects/typeobject.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/Objects/typeobject.c b/Objects/typeobject.c index eeaae1f..b28f494 100644 --- a/Objects/typeobject.c +++ b/Objects/typeobject.c @@ -2995,6 +2995,7 @@ PyType_FromSpecWithBases(PyType_Spec *spec, PyObject *bases) size_t len = strlen(old_doc)+1; char *tp_doc = PyObject_MALLOC(len); if (tp_doc == NULL) { + type->tp_doc = NULL; PyErr_NoMemory(); goto fail; } |