From 6c14f231005a2a3a63bd4b0157c908e94bd834ac Mon Sep 17 00:00:00 2001 From: Benjamin Peterson Date: Wed, 12 Nov 2014 10:19:46 -0500 Subject: fix possible double free in TextIOWrapper.__init__ (closes #22849) --- Lib/test/test_io.py | 15 +++++++++++++++ Misc/NEWS | 2 ++ Modules/_io/textio.c | 2 +- 3 files changed, 18 insertions(+), 1 deletion(-) diff --git a/Lib/test/test_io.py b/Lib/test/test_io.py index b5506b0..940e921 100644 --- a/Lib/test/test_io.py +++ b/Lib/test/test_io.py @@ -2784,6 +2784,21 @@ class TextIOWrapperTest(unittest.TestCase): self.assertFalse(err) self.assertEqual("ok", out.decode().strip()) + def test_issue22849(self): + class F(object): + def readable(self): return True + def writable(self): return True + def seekable(self): return True + + for i in range(10): + try: + self.TextIOWrapper(F(), encoding='utf-8') + except Exception: + pass + + F.tell = lambda x: 0 + t = self.TextIOWrapper(F(), encoding='utf-8') + class CTextIOWrapperTest(TextIOWrapperTest): io = io diff --git a/Misc/NEWS b/Misc/NEWS index 7331e99..bb58965 100644 --- a/Misc/NEWS +++ b/Misc/NEWS @@ -36,6 +36,8 @@ Core and Builtins Library ------- +- Issue #22849: Fix possible double free in the io.TextIOWrapper constructor. + - Issue #12728: Different Unicode characters having the same uppercase but different lowercase are now matched in case-insensitive regular expressions. diff --git a/Modules/_io/textio.c b/Modules/_io/textio.c index a3e82a8..4555bf7 100644 --- a/Modules/_io/textio.c +++ b/Modules/_io/textio.c @@ -1061,7 +1061,7 @@ textiowrapper_init(textio *self, PyObject *args, PyObject *kwds) } /* Finished sorting out the codec details */ - Py_DECREF(codec_info); + Py_CLEAR(codec_info); self->buffer = buffer; Py_INCREF(buffer); -- cgit v0.12