SF #1444030: Fix several potential defects found by Coverity.

(reviewed by Neal Norwitz)

4 files changed, 30 insertions, 11 deletions

diff --git a/Objects/longobject.c b/Objects/longobject.c
index 345d3b4..9032656 100644
--- a/Objects/longobject.c
+++ b/Objects/longobject.c
@@ -2809,6 +2809,8 @@ long_bitwise(PyLongObject *a,
 
 	if (a->ob_size < 0) {
 		a = (PyLongObject *) long_invert(a);
+		if (a == NULL)
+			return NULL;
 		maska = MASK;
 	}
 	else {
@@ -2817,6 +2819,10 @@ long_bitwise(PyLongObject *a,
 	}
 	if (b->ob_size < 0) {
 		b = (PyLongObject *) long_invert(b);
+		if (b == NULL) {
+			Py_DECREF(a);
+			return NULL;
+		}
 		maskb = MASK;
 	}
 	else {
@@ -2868,7 +2874,7 @@ long_bitwise(PyLongObject *a,
 		   : (maskb ? size_a : MIN(size_a, size_b)))
 		: MAX(size_a, size_b);
 	z = _PyLong_New(size_z);
-	if (a == NULL || b == NULL || z == NULL) {
+	if (z == NULL) {
 		Py_XDECREF(a);
 		Py_XDECREF(b);
 		Py_XDECREF(z);
diff --git a/Objects/stringobject.c b/Objects/stringobject.c
index 0030ac7..e2b7603 100644
--- a/Objects/stringobject.c
+++ b/Objects/stringobject.c
@@ -3276,7 +3276,7 @@ string_splitlines(PyStringObject *self, PyObject *args)
     return list;
 
  onError:
-    Py_DECREF(list);
+    Py_XDECREF(list);
     return NULL;
 }
 
diff --git a/Objects/unicodeobject.c b/Objects/unicodeobject.c
index 3aaf98e..4146f1d 100644
--- a/Objects/unicodeobject.c
+++ b/Objects/unicodeobject.c
@@ -1876,16 +1876,16 @@ PyObject *PyUnicode_DecodeUnicodeEscape(const char *s,
             message = "malformed \\N character escape";
             if (ucnhash_CAPI == NULL) {
                 /* load the unicode data module */
-                PyObject *m, *v;
+                PyObject *m, *api;
                 m = PyImport_ImportModule("unicodedata");
                 if (m == NULL)
                     goto ucnhashError;
-                v = PyObject_GetAttrString(m, "ucnhash_CAPI");
+                api = PyObject_GetAttrString(m, "ucnhash_CAPI");
                 Py_DECREF(m);
-                if (v == NULL)
+                if (api == NULL)
                     goto ucnhashError;
-                ucnhash_CAPI = PyCObject_AsVoidPtr(v);
-                Py_DECREF(v);
+                ucnhash_CAPI = PyCObject_AsVoidPtr(api);
+                Py_DECREF(api);
                 if (ucnhash_CAPI == NULL)
                     goto ucnhashError;
             }
@@ -1945,6 +1945,7 @@ ucnhashError:
         PyExc_UnicodeError,
         "\\N escapes not supported (can't load unicodedata module)"
         );
+    Py_XDECREF(v);
     Py_XDECREF(errorHandler);
     Py_XDECREF(exc);
     return NULL;
@@ -3962,7 +3963,7 @@ Py_ssize_t PyUnicode_Tailmatch(PyObject *str,
 	return -1;
     substr = PyUnicode_FromObject(substr);
     if (substr == NULL) {
-	Py_DECREF(substr);
+	Py_DECREF(str);
 	return -1;
     }
 
@@ -4429,7 +4430,7 @@ PyObject *PyUnicode_Splitlines(PyObject *string,
     return list;
 
  onError:
-    Py_DECREF(list);
+    Py_XDECREF(list);
     Py_DECREF(string);
     return NULL;
 }
@@ -6679,6 +6680,10 @@ formatlong(PyObject *val, int flags, int prec, int type)
 	if (!str)
 		return NULL;
 	result = _PyUnicode_New(len);
+	if (!result) {
+		Py_DECREF(str);
+		return NULL;
+	}
 	for (i = 0; i < len; i++)
 		result->str[i] = buf[i];
 	result->str[len] = 0;
@@ -6865,7 +6870,7 @@ PyObject *PyUnicode_Format(PyObject *format,
 		rescnt = fmtcnt + 100;
 		reslen += rescnt;
 		if (_PyUnicode_Resize(&result, reslen) < 0)
-		    return NULL;
+		    goto onError;
 		res = PyUnicode_AS_UNICODE(result) + reslen - rescnt;
 		--rescnt;
 	    }
@@ -7163,6 +7168,7 @@ PyObject *PyUnicode_Format(PyObject *format,
 		rescnt = width + fmtcnt + 100;
 		reslen += rescnt;
 		if (reslen < 0) {
+		    Py_XDECREF(temp);
 		    Py_DECREF(result);
 		    return PyErr_NoMemory();
 		}
diff --git a/Objects/weakrefobject.c b/Objects/weakrefobject.c
index 4a64ef7..1d68bb5 100644
--- a/Objects/weakrefobject.c
+++ b/Objects/weakrefobject.c
@@ -903,8 +903,15 @@ PyObject_ClearWeakRefs(PyObject *object)
             }
         }
         else {
-            PyObject *tuple = PyTuple_New(count * 2);
+            PyObject *tuple;
             Py_ssize_t i = 0;
+    
+            tuple = PyTuple_New(count * 2);
+            if (tuple == NULL) {
+                if (restore_error)
+                    PyErr_Fetch(&err_type, &err_value, &err_tb);
+                return;
+            }
 
             for (i = 0; i < count; ++i) {
                 PyWeakReference *next = current->wr_next;