From 1e5e9413d4682c73ebbfeb3ae6a41a11b3dc4703 Mon Sep 17 00:00:00 2001 From: Zackery Spytz Date: Thu, 9 May 2019 12:33:32 -0600 Subject: [3.7] Fix a possible crash due to PyType_FromSpecWithBases() (GH-10304) If the PyObject_MALLOC() call failed in PyType_FromSpecWithBases(), PyObject_Free() would be called on a static string in type_dealloc(). (cherry picked from commit 0613c1e481440aa8f54ba7f6056924c175fbcc13) Co-authored-by: Zackery Spytz --- Objects/typeobject.c | 1 + 1 file changed, 1 insertion(+) diff --git a/Objects/typeobject.c b/Objects/typeobject.c index 8adae49a7f..134590564e 100644 --- a/Objects/typeobject.c +++ b/Objects/typeobject.c @@ -2938,6 +2938,7 @@ PyType_FromSpecWithBases(PyType_Spec *spec, PyObject *bases) size_t len = strlen(old_doc)+1; char *tp_doc = PyObject_MALLOC(len); if (tp_doc == NULL) { + type->tp_doc = NULL; PyErr_NoMemory(); goto fail; } -- cgit v1.2.1