Issue #16215: Fix potential double memory free in str.replace().

Patch by Serhiy Storchaka.
This commit is contained in:
Antoine Pitrou 2012-11-17 23:28:17 +01:00
parent fa7aeecbca
commit 6d5ad227a5
2 changed files with 5 additions and 0 deletions

View file

@ -10118,6 +10118,7 @@ replace(PyObject *self, PyObject *str1,
/* widen self and buf1 */
rkind = kind2;
if (release1) PyMem_Free(buf1);
release1 = 0;
sbuf = _PyUnicode_AsKind(self, rkind);
if (!sbuf) goto error;
srelease = 1;
@ -10179,6 +10180,7 @@ replace(PyObject *self, PyObject *str1,
if (!sbuf) goto error;
srelease = 1;
if (release1) PyMem_Free(buf1);
release1 = 0;
buf1 = _PyUnicode_AsKind(str1, rkind);
if (!buf1) goto error;
release1 = 1;