mirrors/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2025-08-04 08:59:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 11

SF bug #1238681: freed pointer is used in longobject.c:long_pow().

Browse source 
In addition, long_pow() skipped a necessary (albeit extremely unlikely
to trigger) error check when converting an int modulus to long.

Alas, I was unable to write a test case that crashed due to either
cause.

Bugfix candidate.
This commit is contained in:
Tim Peters 2005-07-17 23:45:23 +00:00
parent f5f32b4712
commit de7990b8af
2 changed files with 10 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

13
Objects/longobject.c
View file

@ -2360,8 +2360,11 @@ long_pow(PyObject *v, PyObject *w, PyObject *x)
c = (PyLongObject *)x;
Py_INCREF(x);
}
else if (PyInt_Check(x))
else if (PyInt_Check(x)) {
c = (PyLongObject *)PyLong_FromLong(PyInt_AS_LONG(x));
if (c == NULL)
goto Error;
}
else if (x == Py_None)
c = NULL;
else {
@ -2511,14 +2514,14 @@ long_pow(PyObject *v, PyObject *w, PyObject *x)
}
/* fall through */
Done:
Py_XDECREF(a);
Py_XDECREF(b);
Py_XDECREF(c);
Py_XDECREF(temp);
if (b->ob_size > FIVEARY_CUTOFF) {
for (i = 0; i < 32; ++i)
Py_XDECREF(table[i]);
}
Py_DECREF(a);
Py_DECREF(b);
Py_XDECREF(c);
Py_XDECREF(temp);
return (PyObject *)z;
}