From 6d5ad227a50c6c5a78e48a98095788953ab49512 Mon Sep 17 00:00:00 2001 From: Antoine Pitrou Date: Sat, 17 Nov 2012 23:28:17 +0100 Subject: Issue #16215: Fix potential double memory free in str.replace(). Patch by Serhiy Storchaka. --- Misc/NEWS | 3 +++ Objects/unicodeobject.c | 2 ++ 2 files changed, 5 insertions(+) diff --git a/Misc/NEWS b/Misc/NEWS index 217eecd7..b68ead6 100644 --- a/Misc/NEWS +++ b/Misc/NEWS @@ -12,6 +12,9 @@ What's New in Python 3.3.1? Core and Builtins ----------------- +- Issue #16215: Fix potential double memory free in str.replace(). Patch + by Serhiy Storchaka. + - Issue #16453: Fix equality testing of dead weakref objects. - Issue #9535: Fix pending signals that have been received but not yet diff --git a/Objects/unicodeobject.c b/Objects/unicodeobject.c index 665f03d..b9ac834 100644 --- a/Objects/unicodeobject.c +++ b/Objects/unicodeobject.c @@ -10118,6 +10118,7 @@ replace(PyObject *self, PyObject *str1, /* widen self and buf1 */ rkind = kind2; if (release1) PyMem_Free(buf1); + release1 = 0; sbuf = _PyUnicode_AsKind(self, rkind); if (!sbuf) goto error; srelease = 1; @@ -10179,6 +10180,7 @@ replace(PyObject *self, PyObject *str1, if (!sbuf) goto error; srelease = 1; if (release1) PyMem_Free(buf1); + release1 = 0; buf1 = _PyUnicode_AsKind(str1, rkind); if (!buf1) goto error; release1 = 1; -- cgit v0.12