[Python-checkins] Fix a possible crash due to PyType_FromSpecWithBases() (GH-10304)

Thu May 9 14:33:35 EDT 2019

https://github.com/python/cpython/commit/0613c1e481440aa8f54ba7f6056924c175fbcc13
commit: 0613c1e481440aa8f54ba7f6056924c175fbcc13
branch: master
author: Zackery Spytz <zspytz at gmail.com>
committer: Petr Viktorin <pviktori at redhat.com>
date: 2019年05月09日T14:33:31-04:00
summary:
Fix a possible crash due to PyType_FromSpecWithBases() (GH-10304)
If the PyObject_MALLOC() call failed in PyType_FromSpecWithBases(),
PyObject_Free() would be called on a static string in type_dealloc().
files:
M Objects/typeobject.c

diff --git a/Objects/typeobject.c b/Objects/typeobject.c
index eeaae1f9f789..b28f494962ec 100644
--- a/Objects/typeobject.c
+++ b/Objects/typeobject.c
@@ -2995,6 +2995,7 @@ PyType_FromSpecWithBases(PyType_Spec *spec, PyObject *bases)
 size_t len = strlen(old_doc)+1;
 char *tp_doc = PyObject_MALLOC(len);
 if (tp_doc == NULL) {
+ type->tp_doc = NULL;
 PyErr_NoMemory();
 goto fail;
 }
