diff options
| author |   Walter Dörwald <walter@livinglogic.de> | 2003-08-18 18:34:09 +0000 |
|---|---|---|
| committer | Walter Dörwald <walter@livinglogic.de> | 2003-08-18 18:34:09 +0000 |
| commit | afa2448b2ae035aab0898361ed89881aef9b80a1 (patch) | |
| tree | 92dce6dc2fcbd458f6ba670cbfef85b70856e895 /Python | |
| parent | Remove a stray single quote. (diff) | |
| download | cpython-afa2448b2ae035aab0898361ed89881aef9b80a1.tar.gz cpython-afa2448b2ae035aab0898361ed89881aef9b80a1.tar.bz2 cpython-afa2448b2ae035aab0898361ed89881aef9b80a1.zip | |
Backport checkin:
Fix a crash: when sq_item failed the code continued blindly and used the
NULL pointer. (Detected by Michael Hudson, patch provided by Neal Norwitz).
Fix refcounting leak in filtertuple().
Diffstat (limited to 'Python')
| -rw-r--r-- | Python/bltinmodule.c | 13 |
1 files changed, 10 insertions, 3 deletions
diff --git a/Python/bltinmodule.c b/Python/bltinmodule.c index 49fcc09cfc0..e10d16ba65f 100644 --- a/Python/bltinmodule.c +++ b/Python/bltinmodule.c @@ -2176,6 +2176,8 @@ filtertuple(PyObject *func, PyObject *tuple) if (tuple->ob_type->tp_as_sequence && tuple->ob_type->tp_as_sequence->sq_item) { item = tuple->ob_type->tp_as_sequence->sq_item(tuple, i); + if (item == NULL) + goto Fail_1; } else { PyErr_SetString(PyExc_TypeError, "filter(): unsubscriptable tuple"); goto Fail_1; @@ -2186,20 +2188,25 @@ filtertuple(PyObject *func, PyObject *tuple) } else { PyObject *arg = Py_BuildValue("(O)", item); - if (arg == NULL) + if (arg == NULL) { + Py_DECREF(item); goto Fail_1; + } good = PyEval_CallObject(func, arg); Py_DECREF(arg); - if (good == NULL) + if (good == NULL) { + Py_DECREF(item); goto Fail_1; + } } ok = PyObject_IsTrue(good); Py_DECREF(good); if (ok) { - Py_INCREF(item); if (PyTuple_SetItem(result, j++, item) < 0) goto Fail_1; } + else + Py_DECREF(item); } if (_PyTuple_Resize(&result, j) < 0) |