From bfb855bef6b428d639693caaf4e4c84cbb8a2f51 Mon Sep 17 00:00:00 2001 From: Pablo Galindo Date: Thu, 15 Nov 2018 02:03:57 +0000 Subject: bpo-34784: Implement correct cleanup in PyStructSequence new implementation (GH-10536) PyTuple_Pack can fail and return NULL. If this happens, then PyType_FromSpecWithBases will incorrectly create a new type without bases. Also, it will crash on the Py_DECREF that follows. Also free members and type in error conditions. --- Objects/structseq.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/Objects/structseq.c b/Objects/structseq.c index d513710..05ea87b 100644 --- a/Objects/structseq.c +++ b/Objects/structseq.c @@ -447,6 +447,10 @@ PyStructSequence_NewType(PyStructSequence_Desc *desc) spec.slots = slots; bases = PyTuple_Pack(1, &PyTuple_Type); + if (bases == NULL) { + PyMem_FREE(members); + return NULL; + } type = (PyTypeObject *)PyType_FromSpecWithBases(&spec, bases); Py_DECREF(bases); PyMem_FREE(members); @@ -456,6 +460,7 @@ PyStructSequence_NewType(PyStructSequence_Desc *desc) if (initialize_structseq_dict( desc, type->tp_dict, n_members, n_unnamed_members) < 0) { + Py_DECREF(type); return NULL; } -- cgit v0.12