From 3708316afa061dc6c1c6a1207f4998974cfa0752 Mon Sep 17 00:00:00 2001 From: Petr Viktorin Date: Wed, 29 May 2019 05:35:33 +0200 Subject: [3.7] Fix a possible crash due to PyType_FromSpecWithBases() (GH-10304) (GH-13495) If the PyObject_MALLOC() call failed in PyType_FromSpecWithBases(), PyObject_Free() would be called on a static string in type_dealloc(). (cherry picked from commit 0613c1e481440aa8f54ba7f6056924c175fbcc13) Co-authored-by: Zackery Spytz --- Objects/typeobject.c | 1 + 1 file changed, 1 insertion(+) (limited to 'Objects') diff --git a/Objects/typeobject.c b/Objects/typeobject.c index 3092e98f6b..7065ee518e 100644 --- a/Objects/typeobject.c +++ b/Objects/typeobject.c @@ -2960,6 +2960,7 @@ PyType_FromSpecWithBases(PyType_Spec *spec, PyObject *bases) size_t len = strlen(old_doc)+1; char *tp_doc = PyObject_MALLOC(len); if (tp_doc == NULL) { + type->tp_doc = NULL; PyErr_NoMemory(); goto fail; } -- cgit v1.2.1