From 7f944144855e431e6f74a743c9fc6afd7279f149 Mon Sep 17 00:00:00 2001 From: Georg Brandl Date: Mon, 18 Jul 2005 07:24:37 +0000 Subject: backporting fix by tim_one: """ SF bug #1238681: freed pointer is used in longobject.c:long_pow(). In addition, long_pow() skipped a necessary (albeit extremely unlikely to trigger) error check when converting an int modulus to long. Alas, I was unable to write a test case that crashed due to either cause. """ --- Misc/NEWS | 2 ++ Objects/longobject.c | 13 ++++++++----- 2 files changed, 10 insertions(+), 5 deletions(-) diff --git a/Misc/NEWS b/Misc/NEWS index 875c148..fff4715 100644 --- a/Misc/NEWS +++ b/Misc/NEWS @@ -12,6 +12,8 @@ What's New in Python 2.4.2a Core and builtins ----------------- +- SF bug #1238681: freed pointer is used in longobject.c:long_pow(). + - SF bug #1185883: Python's small-object memory allocator took over a block managed by the platform C library whenever a realloc specified a small new size. However, there's no portable way to know then how diff --git a/Objects/longobject.c b/Objects/longobject.c index 11a7024..ced72e1 100644 --- a/Objects/longobject.c +++ b/Objects/longobject.c @@ -2360,8 +2360,11 @@ long_pow(PyObject *v, PyObject *w, PyObject *x) c = (PyLongObject *)x; Py_INCREF(x); } - else if (PyInt_Check(x)) + else if (PyInt_Check(x)) { c = (PyLongObject *)PyLong_FromLong(PyInt_AS_LONG(x)); + if (c == NULL) + goto Error; + } else if (x == Py_None) c = NULL; else { @@ -2511,14 +2514,14 @@ long_pow(PyObject *v, PyObject *w, PyObject *x) } /* fall through */ Done: - Py_XDECREF(a); - Py_XDECREF(b); - Py_XDECREF(c); - Py_XDECREF(temp); if (b->ob_size > FIVEARY_CUTOFF) { for (i = 0; i < 32; ++i) Py_XDECREF(table[i]); } + Py_DECREF(a); + Py_DECREF(b); + Py_XDECREF(c); + Py_XDECREF(temp); return (PyObject *)z; } -- cgit v0.12