mirror of
				https://github.com/python/cpython.git
				synced 2025-10-31 13:41:24 +00:00 
			
		
		
		
	Fix a crash: when sq_item failed the code continued blindly and used the
NULL pointer. (Detected by Michael Hudson, patch provided by Neal Norwitz). Fix refcounting leak in filtertuple().
This commit is contained in:
		
							parent
							
								
									6019f9a65d
								
							
						
					
					
						commit
						c58a3a10a9
					
				
					 1 changed files with 10 additions and 3 deletions
				
			
		|  | @ -2174,6 +2174,8 @@ filtertuple(PyObject *func, PyObject *tuple) | |||
| 		if (tuple->ob_type->tp_as_sequence && | ||||
| 		    tuple->ob_type->tp_as_sequence->sq_item) { | ||||
| 			item = tuple->ob_type->tp_as_sequence->sq_item(tuple, i); | ||||
| 			if (item == NULL) | ||||
| 				goto Fail_1; | ||||
| 		} else { | ||||
| 			PyErr_SetString(PyExc_TypeError, "filter(): unsubscriptable tuple"); | ||||
| 			goto Fail_1; | ||||
|  | @ -2184,20 +2186,25 @@ filtertuple(PyObject *func, PyObject *tuple) | |||
| 		} | ||||
| 		else { | ||||
| 			PyObject *arg = Py_BuildValue("(O)", item); | ||||
| 			if (arg == NULL) | ||||
| 			if (arg == NULL) { | ||||
| 				Py_DECREF(item); | ||||
| 				goto Fail_1; | ||||
| 			} | ||||
| 			good = PyEval_CallObject(func, arg); | ||||
| 			Py_DECREF(arg); | ||||
| 			if (good == NULL) | ||||
| 			if (good == NULL) { | ||||
| 				Py_DECREF(item); | ||||
| 				goto Fail_1; | ||||
| 			} | ||||
| 		} | ||||
| 		ok = PyObject_IsTrue(good); | ||||
| 		Py_DECREF(good); | ||||
| 		if (ok) { | ||||
| 			Py_INCREF(item); | ||||
| 			if (PyTuple_SetItem(result, j++, item) < 0) | ||||
| 				goto Fail_1; | ||||
| 		} | ||||
| 		else | ||||
| 			Py_DECREF(item); | ||||
| 	} | ||||
| 
 | ||||
| 	if (_PyTuple_Resize(&result, j) < 0) | ||||
|  |  | |||
		Loading…
	
	Add table
		Add a link
		
	
		Reference in a new issue
	
	 Walter Dörwald
						Walter Dörwald