mirrors/cpython
0
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2024-11-24 18:34:43 +08:00
Code Issues Packages Projects Releases Wiki Activity

SF bug #1238681: freed pointer is used in longobject.c:long_pow().

Browse Source 
In addition, long_pow() skipped a necessary (albeit extremely unlikely
to trigger) error check when converting an int modulus to long.

Alas, I was unable to write a test case that crashed due to either
cause.

Bugfix candidate.
This commit is contained in:
Tim Peters 2005-07-17 23:45:23 +00:00
parent f5f32b4712
commit de7990b8af
2 changed files with 10 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Misc/NEWS
View File

@ -12,6 +12,8 @@ What's New in Python 2.5 alpha 1?
Core and builtins
-----------------
- SF bug #1238681: freed pointer is used in longobject.c:long_pow().
- SF bug #1229429: PyObject_CallMethod failed to decrement some
reference counts in some error exit cases.

13
Objects/longobject.c
View File

@ -2360,8 +2360,11 @@ long_pow(PyObject *v, PyObject *w, PyObject *x)
c = (PyLongObject *)x;
Py_INCREF(x);
}
else if (PyInt_Check(x))
else if (PyInt_Check(x)) {
c = (PyLongObject *)PyLong_FromLong(PyInt_AS_LONG(x));
if (c == NULL)
goto Error;
}
else if (x == Py_None)
c = NULL;
else {
@ -2511,14 +2514,14 @@ long_pow(PyObject *v, PyObject *w, PyObject *x)
}
/* fall through */
Done:
Py_XDECREF(a);
Py_XDECREF(b);
Py_XDECREF(c);
Py_XDECREF(temp);
if (b->ob_size > FIVEARY_CUTOFF) {
for (i = 0; i < 32; ++i)
Py_XDECREF(table[i]);
}
Py_DECREF(a);
Py_DECREF(b);
Py_XDECREF(c);
Py_XDECREF(temp);
return (PyObject *)z;
}