[Python-checkins] cpython (merge 3.3 -> default): Issue #16215: Fix potential double memory free in str.replace().

Sat Nov 17 23:30:54 CET 2012

http://hg.python.org/cpython/rev/5f2624db78bd
changeset: 80481:5f2624db78bd
parent: 80477:e9af9b1ca67e
parent: 80480:26e5234239ae
user: Antoine Pitrou <solipsis at pitrou.net>
date: Sat Nov 17 23:29:28 2012 +0100
summary:
 Issue #16215: Fix potential double memory free in str.replace().
Patch by Serhiy Storchaka.
files:
 Misc/NEWS | 3 +++
 Objects/unicodeobject.c | 2 ++
 2 files changed, 5 insertions(+), 0 deletions(-)

diff --git a/Misc/NEWS b/Misc/NEWS
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -10,6 +10,9 @@
 Core and Builtins
 -----------------
 
+- Issue #16215: Fix potential double memory free in str.replace(). Patch
+ by Serhiy Storchaka.
+
 - Issue #16290: A float return value from the __complex__ special method is no
 longer accepted in the complex() constructor.
 
diff --git a/Objects/unicodeobject.c b/Objects/unicodeobject.c
--- a/Objects/unicodeobject.c
+++ b/Objects/unicodeobject.c
@@ -9959,6 +9959,7 @@
 /* widen self and buf1 */
 rkind = kind2;
 if (release1) PyMem_Free(buf1);
+ release1 = 0;
 sbuf = _PyUnicode_AsKind(self, rkind);
 if (!sbuf) goto error;
 srelease = 1;
@@ -10020,6 +10021,7 @@
 if (!sbuf) goto error;
 srelease = 1;
 if (release1) PyMem_Free(buf1);
+ release1 = 0;
 buf1 = _PyUnicode_AsKind(str1, rkind);
 if (!buf1) goto error;
 release1 = 1;
-- 
Repository URL: http://hg.python.org/cpython
