[Python-checkins] Fix several reference counting bugs in pyexpat.c. (GH-9955)

Fri Oct 19 03:26:41 EDT 2018

https://github.com/python/cpython/commit/5744a3362945e0d9cd7bb24ed5ebcedba8822d4c
commit: 5744a3362945e0d9cd7bb24ed5ebcedba8822d4c
branch: 2.7
author: Miss Islington (bot) <31488909+miss-islington at users.noreply.github.com>
committer: GitHub <noreply at github.com>
date: 2018年10月19日T00:26:37-07:00
summary:
Fix several reference counting bugs in pyexpat.c. (GH-9955)
(cherry picked from commit 68def052dcd41313eff2bd9f269e22c5a941db4d)
Co-authored-by: Zackery Spytz <zspytz at gmail.com>
files:
M Modules/pyexpat.c

diff --git a/Modules/pyexpat.c b/Modules/pyexpat.c
index 1f8c0d70a559..bbda6ffd0242 100644
--- a/Modules/pyexpat.c
+++ b/Modules/pyexpat.c
@@ -398,8 +398,10 @@ string_intern(xmlparseobject *self, const char* str)
 if (!value) {
 if (PyDict_SetItem(self->intern, result, result) == 0)
 return result;
- else
+ else {
+ Py_DECREF(result);
 return NULL;
+ }
 }
 Py_INCREF(value);
 Py_DECREF(result);
@@ -547,6 +549,7 @@ my_StartElementHandler(void *userData,
 flag_error(self);
 Py_DECREF(n);
 Py_DECREF(v);
+ Py_DECREF(container);
 return;
 }
 else {
@@ -555,12 +558,14 @@ my_StartElementHandler(void *userData,
 }
 }
 args = string_intern(self, name);
- if (args != NULL)
- args = Py_BuildValue("(NN)", args, container);
 if (args == NULL) {
 Py_DECREF(container);
 return;
 }
+ args = Py_BuildValue("(NN)", args, container);
+ if (args == NULL) {
+ return;
+ }
 /* Container is now a borrowed reference; ignore it. */
 self->in_callback = 1;
 rv = call_with_frame(getcode(StartElement, "StartElement", __LINE__),
@@ -742,7 +747,6 @@ my_ElementDeclHandler(void *userData,
 }
 args = Py_BuildValue("NN", nameobj, modelobj);
 if (args == NULL) {
- Py_DECREF(modelobj);
 flag_error(self);
 goto finally;
 }
