From 0eef443f0142b8cee705a22d0d1c9df17be94f69 Mon Sep 17 00:00:00 2001 From: "Miss Islington (bot)" <31488909+miss-islington@users.noreply.github.com> Date: Thu, 5 May 2022 21:38:14 -0700 Subject: Issues/88027: A potential double free in list_sort_impl (GH-92367) merge_freemem(): set keys to NULL do it's harmless to call this again. (cherry picked from commit 9652900969df77b1ac245595419431df19296af9) Co-authored-by: Tim Peters --- Objects/listobject.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/Objects/listobject.c b/Objects/listobject.c index 533ee74..d3bc576 100644 --- a/Objects/listobject.c +++ b/Objects/listobject.c @@ -1548,8 +1548,10 @@ static void merge_freemem(MergeState *ms) { assert(ms != NULL); - if (ms->a.keys != ms->temparray) + if (ms->a.keys != ms->temparray) { PyMem_Free(ms->a.keys); + ms->a.keys = NULL; + } } /* Ensure enough temp memory for 'need' array slots is available. -- cgit v0.12