commit 6d5ad227a50c6c5a78e48a98095788953ab49512
author Antoine Pitrou <solipsis@pitrou.net> Sat Nov 17 23:28:17 2012 +0100
committer Antoine Pitrou <solipsis@pitrou.net> Sat Nov 17 23:28:17 2012 +0100
tree 9890bd98fc7c2069fcea429811e4c42f6590508a
parent fa7aeecbca8265b81749c0c7c85704070c8eeefe

Issue #16215: Fix potential double memory free in str.replace().
Patch by Serhiy Storchaka.

Objects/unicodeobject.c

diff --git a/Objects/unicodeobject.c b/Objects/unicodeobject.c
index 665f03d..b9ac834 100644
--- a/Objects/unicodeobject.c
+++ b/Objects/unicodeobject.c
@@ -10118,6 +10118,7 @@
                 /* widen self and buf1 */
                 rkind = kind2;
                 if (release1) PyMem_Free(buf1);
+                release1 = 0;
                 sbuf = _PyUnicode_AsKind(self, rkind);
                 if (!sbuf) goto error;
                 srelease = 1;
@@ -10179,6 +10180,7 @@
             if (!sbuf) goto error;
             srelease = 1;
             if (release1) PyMem_Free(buf1);
+            release1 = 0;
             buf1 = _PyUnicode_AsKind(str1, rkind);
             if (!buf1) goto error;
             release1 = 1;