diff options
| author | Zackery Spytz <zspytz@gmail.com> | 2019-05-09 12:33:32 -0600 |
|---|---|---|
| committer | Petr Viktorin <pviktori@redhat.com> | 2019-05-22 16:06:13 +0200 |
| commit | 1e5e9413d4682c73ebbfeb3ae6a41a11b3dc4703 (patch) | |
| tree | e6086df53d95c5aa4e78408a4fd664d380ed8f51 | |
| parent | d092caf096fa48baadfc0900792206bb5aa0192d (diff) | |
| download | cpython-git-backport-0613c1e-3.7.tar.gz | |
[3.7] Fix a possible crash due to PyType_FromSpecWithBases() (GH-10304)backport-0613c1e-3.7
If the PyObject_MALLOC() call failed in PyType_FromSpecWithBases(),
PyObject_Free() would be called on a static string in type_dealloc().
(cherry picked from commit 0613c1e481440aa8f54ba7f6056924c175fbcc13)
Co-authored-by: Zackery Spytz <zspytz@gmail.com>
| -rw-r--r-- | Objects/typeobject.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/Objects/typeobject.c b/Objects/typeobject.c index 8adae49a7f..134590564e 100644 --- a/Objects/typeobject.c +++ b/Objects/typeobject.c @@ -2938,6 +2938,7 @@ PyType_FromSpecWithBases(PyType_Spec *spec, PyObject *bases) size_t len = strlen(old_doc)+1; char *tp_doc = PyObject_MALLOC(len); if (tp_doc == NULL) { + type->tp_doc = NULL; PyErr_NoMemory(); goto fail; } |