SF patch #1467512, fix double free with triple quoted string in standard build.
This was the result of inconsistent use of PyMem_* and PyObject_* allocators.
By changing to use PyObject_* allocator almost everywhere, this removes
the inconsistency.
diff --git a/Parser/pgen.c b/Parser/pgen.c
index e643d33..6aa1d19 100644
--- a/Parser/pgen.c
+++ b/Parser/pgen.c
@@ -49,7 +49,8 @@
{
nfastate *st;
- PyMem_RESIZE(nf->nf_state, nfastate, nf->nf_nstates + 1);
+ nf->nf_state = PyObject_REALLOC(nf->nf_state, sizeof(nfastate) *
+ (nf->nf_nstates + 1));
if (nf->nf_state == NULL)
Py_FatalError("out of mem");
st = &nf->nf_state[nf->nf_nstates++];
@@ -65,7 +66,8 @@
nfaarc *ar;
st = &nf->nf_state[from];
- PyMem_RESIZE(st->st_arc, nfaarc, st->st_narcs + 1);
+ st->st_arc = PyObject_REALLOC(st->st_arc,
+ sizeof(nfaarc) * (st->st_narcs + 1));
if (st->st_arc == NULL)
Py_FatalError("out of mem");
ar = &st->st_arc[st->st_narcs++];
@@ -79,7 +81,7 @@
nfa *nf;
static int type = NT_OFFSET; /* All types will be disjunct */
- nf = PyMem_NEW(nfa, 1);
+ nf = PyObject_MALLOC(sizeof(nfa));
if (nf == NULL)
Py_FatalError("no mem for new nfa");
nf->nf_type = type++;
@@ -104,7 +106,7 @@
{
nfagrammar *gr;
- gr = PyMem_NEW(nfagrammar, 1);
+ gr = PyObject_MALLOC(sizeof(nfagrammar));
if (gr == NULL)
Py_FatalError("no mem for new nfa grammar");
gr->gr_nnfas = 0;
@@ -121,7 +123,8 @@
nfa *nf;
nf = newnfa(name);
- PyMem_RESIZE(gr->gr_nfa, nfa *, gr->gr_nnfas + 1);
+ gr->gr_nfa = PyObject_REALLOC(gr->gr_nfa,
+ sizeof(nfa) * (gr->gr_nnfas + 1));
if (gr->gr_nfa == NULL)
Py_FatalError("out of mem");
gr->gr_nfa[gr->gr_nnfas++] = nf;
@@ -392,7 +395,7 @@
ss = newbitset(nbits);
addclosure(ss, nf, nf->nf_start);
- xx_state = PyMem_NEW(ss_state, 1);
+ xx_state = PyObject_MALLOC(sizeof(ss_state));
if (xx_state == NULL)
Py_FatalError("no mem for xx_state in makedfa");
xx_nstates = 1;
@@ -411,6 +414,7 @@
/* For each unmarked state... */
for (istate = 0; istate < xx_nstates; ++istate) {
+ size_t size;
yy = &xx_state[istate];
ss = yy->ss_ss;
/* For all its states... */
@@ -430,8 +434,9 @@
goto found;
}
/* Add new arc for this state */
- PyMem_RESIZE(yy->ss_arc, ss_arc,
- yy->ss_narcs + 1);
+ size = sizeof(ss_arc) * (yy->ss_narcs + 1);
+ yy->ss_arc = PyObject_REALLOC(yy->ss_arc,
+ size);
if (yy->ss_arc == NULL)
Py_FatalError("out of mem");
zz = &yy->ss_arc[yy->ss_narcs++];
@@ -453,7 +458,8 @@
goto done;
}
}
- PyMem_RESIZE(xx_state, ss_state, xx_nstates + 1);
+ size = sizeof(ss_state) * (xx_nstates + 1);
+ xx_state = PyObject_REALLOC(xx_state, size);
if (xx_state == NULL)
Py_FatalError("out of mem");
zz->sa_arrow = xx_nstates;