diff options
| -rw-r--r-- | Misc/NEWS | 2 | ||||
| -rw-r--r-- | Objects/longobject.c | 13 |
2 files changed, 10 insertions, 5 deletions
@@ -12,6 +12,8 @@ What's New in Python 2.5 alpha 1? Core and builtins ----------------- +- SF bug #1238681: freed pointer is used in longobject.c:long_pow(). + - SF bug #1229429: PyObject_CallMethod failed to decrement some reference counts in some error exit cases. diff --git a/Objects/longobject.c b/Objects/longobject.c index 1f328dd3..ff5ba6f 100644 --- a/Objects/longobject.c +++ b/Objects/longobject.c @@ -2360,8 +2360,11 @@ long_pow(PyObject *v, PyObject *w, PyObject *x) c = (PyLongObject *)x; Py_INCREF(x); } - else if (PyInt_Check(x)) + else if (PyInt_Check(x)) { c = (PyLongObject *)PyLong_FromLong(PyInt_AS_LONG(x)); + if (c == NULL) + goto Error; + } else if (x == Py_None) c = NULL; else { @@ -2511,14 +2514,14 @@ long_pow(PyObject *v, PyObject *w, PyObject *x) } /* fall through */ Done: - Py_XDECREF(a); - Py_XDECREF(b); - Py_XDECREF(c); - Py_XDECREF(temp); if (b->ob_size > FIVEARY_CUTOFF) { for (i = 0; i < 32; ++i) Py_XDECREF(table[i]); } + Py_DECREF(a); + Py_DECREF(b); + Py_XDECREF(c); + Py_XDECREF(temp); return (PyObject *)z; } |