Mercurial > cpython-lru_cache-weakref
diff Objects/longobject.c @ 35254:d61efcd87c8e legacy-trunk
SF bug #1238681: freed pointer is used in longobject.c:long_pow().
In addition, long_pow() skipped a necessary (albeit extremely unlikely
to trigger) error check when converting an int modulus to long.
Alas, I was unable to write a test case that crashed due to either
cause.
Bugfix candidate.
| author | Tim Peters <tim.peters@gmail.com> |
|---|---|
| date | Sun, 17 Jul 2005 23:45:23 +0000 |
| parents | 27a718221e72 |
| children | 9541369b0dca |
line wrap: on
line diff
--- a/Objects/longobject.c Sun Jul 17 23:16:17 2005 +0000 +++ b/Objects/longobject.c Sun Jul 17 23:45:23 2005 +0000 @@ -2360,8 +2360,11 @@ c = (PyLongObject *)x; Py_INCREF(x); } - else if (PyInt_Check(x)) + else if (PyInt_Check(x)) { c = (PyLongObject *)PyLong_FromLong(PyInt_AS_LONG(x)); + if (c == NULL) + goto Error; + } else if (x == Py_None) c = NULL; else { @@ -2511,14 +2514,14 @@ } /* fall through */ Done: - Py_XDECREF(a); - Py_XDECREF(b); - Py_XDECREF(c); - Py_XDECREF(temp); if (b->ob_size > FIVEARY_CUTOFF) { for (i = 0; i < 32; ++i) Py_XDECREF(table[i]); } + Py_DECREF(a); + Py_DECREF(b); + Py_XDECREF(c); + Py_XDECREF(temp); return (PyObject *)z; }