mirrors/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2025-11-26 13:22:51 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 7

SF bug #1238681: freed pointer is used in longobject.c:long_pow().

Browse source 
In addition, long_pow() skipped a necessary (albeit extremely unlikely
to trigger) error check when converting an int modulus to long.

Alas, I was unable to write a test case that crashed due to either
cause.

Bugfix candidate.
This commit is contained in:
Tim Peters 2005-07-17 23:45:23 +00:00
parent f5f32b4712
commit de7990b8af
2 changed files with 10 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

2
Misc/NEWS
View file

@ -12,6 +12,8 @@ What's New in Python 2.5 alpha 1?
Core and builtins Core and builtins
----------------- -----------------
- SF bug #1238681: freed pointer is used in longobject.c:long_pow().
- SF bug #1229429: PyObject_CallMethod failed to decrement some - SF bug #1229429: PyObject_CallMethod failed to decrement some
reference counts in some error exit cases. reference counts in some error exit cases.

13
Objects/longobject.c
View file

@ -2360,8 +2360,11 @@ long_pow(PyObject *v, PyObject *w, PyObject *x)
c = (PyLongObject *)x; c = (PyLongObject *)x;
Py_INCREF(x); Py_INCREF(x);
} }
else if (PyInt_Check(x)) else if (PyInt_Check(x)) {
c = (PyLongObject *)PyLong_FromLong(PyInt_AS_LONG(x)); c = (PyLongObject *)PyLong_FromLong(PyInt_AS_LONG(x));
if (c == NULL)
goto Error;
}
else if (x == Py_None) else if (x == Py_None)
c = NULL; c = NULL;
else { else {
@ -2511,14 +2514,14 @@ long_pow(PyObject *v, PyObject *w, PyObject *x)
} }
/* fall through */ /* fall through */
Done: Done:
Py_XDECREF(a);
Py_XDECREF(b);
Py_XDECREF(c);
Py_XDECREF(temp);
if (b->ob_size > FIVEARY_CUTOFF) { if (b->ob_size > FIVEARY_CUTOFF) {
for (i = 0; i < 32; ++i) for (i = 0; i < 32; ++i)
Py_XDECREF(table[i]); Py_XDECREF(table[i]);
} }
Py_DECREF(a);
Py_DECREF(b);
Py_XDECREF(c);
Py_XDECREF(temp);
return (PyObject *)z; return (PyObject *)z;
} }