diff options
| author | Petr Viktorin <encukou@gmail.com> | 2019-05-29 05:35:33 +0200 |
|---|---|---|
| committer | Ned Deily <nad@python.org> | 2019-05-28 23:35:33 -0400 |
| commit | 3708316afa061dc6c1c6a1207f4998974cfa0752 (patch) | |
| tree | c111f958d63d46c825464c5614e303a6c064849e /Objects | |
| parent | 8ea0fd85bc67438f679491fae29dfe0a3961900a (diff) | |
| download | cpython-git-3708316afa061dc6c1c6a1207f4998974cfa0752.tar.gz | |
[3.7] Fix a possible crash due to PyType_FromSpecWithBases() (GH-10304) (GH-13495)
If the PyObject_MALLOC() call failed in PyType_FromSpecWithBases(),
PyObject_Free() would be called on a static string in type_dealloc().
(cherry picked from commit 0613c1e481440aa8f54ba7f6056924c175fbcc13)
Co-authored-by: Zackery Spytz <zspytz@gmail.com>
Diffstat (limited to 'Objects')
| -rw-r--r-- | Objects/typeobject.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/Objects/typeobject.c b/Objects/typeobject.c index 3092e98f6b..7065ee518e 100644 --- a/Objects/typeobject.c +++ b/Objects/typeobject.c @@ -2960,6 +2960,7 @@ PyType_FromSpecWithBases(PyType_Spec *spec, PyObject *bases) size_t len = strlen(old_doc)+1; char *tp_doc = PyObject_MALLOC(len); if (tp_doc == NULL) { + type->tp_doc = NULL; PyErr_NoMemory(); goto fail; } |