mirrors/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2025-09-29 19:56:59 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 9

Fix several reference counting bugs in pyexpat.c. (GH-9955)

Browse source
This commit is contained in:
Zackery Spytz 2018-10-19 00:57:38 -06:00 • committed by Serhiy Storchaka
parent d16f012f84
commit 68def052dc
1 changed files with 8 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

12
Modules/pyexpat.c
View file

@ -243,8 +243,10 @@ string_intern(xmlparseobject *self, const char* str)
if (!value) { if (!value) {
if (PyDict_SetItem(self->intern, result, result) == 0) if (PyDict_SetItem(self->intern, result, result) == 0)
return result; return result;
else else {
Py_DECREF(result);
return NULL; return NULL;
}
} }
Py_INCREF(value); Py_INCREF(value);
Py_DECREF(result); Py_DECREF(result);
@ -393,6 +395,7 @@ my_StartElementHandler(void *userData,
flag_error(self); flag_error(self);
Py_DECREF(n); Py_DECREF(n);
Py_DECREF(v); Py_DECREF(v);
Py_DECREF(container);
return; return;
} }
else { else {
@ -401,12 +404,14 @@ my_StartElementHandler(void *userData,
} }
} }
args = string_intern(self, name); args = string_intern(self, name);
if (args != NULL)
args = Py_BuildValue("(NN)", args, container);
if (args == NULL) { if (args == NULL) {
Py_DECREF(container); Py_DECREF(container);
return; return;
} }
args = Py_BuildValue("(NN)", args, container);
if (args == NULL) {
return;
}
/* Container is now a borrowed reference; ignore it. */ /* Container is now a borrowed reference; ignore it. */
self->in_callback = 1; self->in_callback = 1;
rv = call_with_frame("StartElement", __LINE__, rv = call_with_frame("StartElement", __LINE__,
@ -565,7 +570,6 @@ my_ElementDeclHandler(void *userData,
} }
args = Py_BuildValue("NN", nameobj, modelobj); args = Py_BuildValue("NN", nameobj, modelobj);
if (args == NULL) { if (args == NULL) {
Py_DECREF(modelobj);
flag_error(self); flag_error(self);
goto finally; goto finally;
} }