SyntaxError__str__(): Fix two memory problems discovered by Insure.

First, the allocated buffer was never freed after using it to create
the PyString object.  Second, it was possible that have_filename would
be false (meaning that filename was not a PyString object), but that
the code would still try to PyString_GET_SIZE() it.

1 files changed, 9 insertions, 4 deletions

diff --git a/Python/exceptions.c b/Python/exceptions.c
index abacda4d99..690af7e92e 100644
--- a/Python/exceptions.c
+++ b/Python/exceptions.c
@@ -775,18 +775,20 @@ SyntaxError__str__(PyObject *self, PyObject *args)
 	int have_lineno = 0;
 	char *buffer = NULL;
 
-	if (filename = PyObject_GetAttrString(self, "filename"))
+	if ((filename = PyObject_GetAttrString(self, "filename")) != NULL)
 	    have_filename = PyString_Check(filename);
 	else
 	    PyErr_Clear();
-	if (lineno = PyObject_GetAttrString(self, "lineno"))
+
+	if ((lineno = PyObject_GetAttrString(self, "lineno")) != NULL)
 	    have_lineno = PyInt_Check(lineno);
 	else
 	    PyErr_Clear();
 
 	if (have_filename || have_lineno) {
-	    int bufsize = (PyString_GET_SIZE(str) + 64 +
-			   PyString_GET_SIZE(filename));
+	    int bufsize = PyString_GET_SIZE(str) + 64;
+	    if (have_filename)
+		bufsize += PyString_GET_SIZE(filename);
 
 	    buffer = PyMem_Malloc(bufsize);
 	    if (buffer != NULL) {
@@ -803,7 +805,10 @@ SyntaxError__str__(PyObject *self, PyObject *args)
 		    sprintf(buffer, "%s (line %d)",
 			    PyString_AS_STRING(str),
 			    PyInt_AsLong(lineno));
+
 		result = PyString_FromString(buffer);
+		PyMem_FREE(buffer);
+
 		if (result == NULL)
 		    result = str;
 		else