diff options
| author | Walter Dörwald <walter@livinglogic.de> | 2003-08-18 18:28:45 (GMT) |
|---|---|---|
| committer | Walter Dörwald <walter@livinglogic.de> | 2003-08-18 18:28:45 (GMT) |
| commit | c58a3a10a91f0c0c2debc2c386bfeee8184e0f86 (patch) | |
| tree | 82f85baf4ab66a23067bf7e06979a8b20f9f0f6b /Python/bltinmodule.c | |
| parent | 6019f9a65d5a5c69f31bf69ea30459d572f2634a (diff) | |
| download | cpython-c58a3a10a91f0c0c2debc2c386bfeee8184e0f86.zip cpython-c58a3a10a91f0c0c2debc2c386bfeee8184e0f86.tar.gz cpython-c58a3a10a91f0c0c2debc2c386bfeee8184e0f86.tar.bz2 | |
Fix a crash: when sq_item failed the code continued blindly and used the
NULL pointer. (Detected by Michael Hudson, patch provided by Neal Norwitz).
Fix refcounting leak in filtertuple().
Diffstat (limited to 'Python/bltinmodule.c')
| -rw-r--r-- | Python/bltinmodule.c | 13 |
1 files changed, 10 insertions, 3 deletions
diff --git a/Python/bltinmodule.c b/Python/bltinmodule.c index 9f41efc..01771cb 100644 --- a/Python/bltinmodule.c +++ b/Python/bltinmodule.c @@ -2174,6 +2174,8 @@ filtertuple(PyObject *func, PyObject *tuple) if (tuple->ob_type->tp_as_sequence && tuple->ob_type->tp_as_sequence->sq_item) { item = tuple->ob_type->tp_as_sequence->sq_item(tuple, i); + if (item == NULL) + goto Fail_1; } else { PyErr_SetString(PyExc_TypeError, "filter(): unsubscriptable tuple"); goto Fail_1; @@ -2184,20 +2186,25 @@ filtertuple(PyObject *func, PyObject *tuple) } else { PyObject *arg = Py_BuildValue("(O)", item); - if (arg == NULL) + if (arg == NULL) { + Py_DECREF(item); goto Fail_1; + } good = PyEval_CallObject(func, arg); Py_DECREF(arg); - if (good == NULL) + if (good == NULL) { + Py_DECREF(item); goto Fail_1; + } } ok = PyObject_IsTrue(good); Py_DECREF(good); if (ok) { - Py_INCREF(item); if (PyTuple_SetItem(result, j++, item) < 0) goto Fail_1; } + else + Py_DECREF(item); } if (_PyTuple_Resize(&result, j) < 0) |