diff Python/bltinmodule.c @ 30182:7bc772527e44 legacy-trunk

Fix a crash: when sq_item failed the code continued blindly and used the NULL pointer. (Detected by Michael Hudson, patch provided by Neal Norwitz). Fix refcounting leak in filtertuple().
author Walter Dörwald <walter@livinglogic.de>
date Mon, 18 Aug 2003 18:28:45 +0000
parents 9f53e53f3880
children c9cc35249322
line wrap: on
line diff
--- a/Python/bltinmodule.c	Mon Aug 18 17:53:33 2003 +0000
+++ b/Python/bltinmodule.c	Mon Aug 18 18:28:45 2003 +0000
@@ -2174,6 +2174,8 @@
 		if (tuple->ob_type->tp_as_sequence &&
 		    tuple->ob_type->tp_as_sequence->sq_item) {
 			item = tuple->ob_type->tp_as_sequence->sq_item(tuple, i);
+			if (item == NULL)
+				goto Fail_1;
 		} else {
 			PyErr_SetString(PyExc_TypeError, "filter(): unsubscriptable tuple");
 			goto Fail_1;
@@ -2184,20 +2186,25 @@
 		}
 		else {
 			PyObject *arg = Py_BuildValue("(O)", item);
-			if (arg == NULL)
+			if (arg == NULL) {
+				Py_DECREF(item);
 				goto Fail_1;
+			}
 			good = PyEval_CallObject(func, arg);
 			Py_DECREF(arg);
-			if (good == NULL)
+			if (good == NULL) {
+				Py_DECREF(item);
 				goto Fail_1;
+			}
 		}
 		ok = PyObject_IsTrue(good);
 		Py_DECREF(good);
 		if (ok) {
-			Py_INCREF(item);
 			if (PyTuple_SetItem(result, j++, item) < 0)
 				goto Fail_1;
 		}
+		else
+			Py_DECREF(item);
 	}
 
 	if (_PyTuple_Resize(&result, j) < 0)