Backport 58385 from trunk: fix a double free bug in the _bsddb module
on DBCursor.get (and a friends) when passing in a string key.
diff --git a/Modules/_bsddb.c b/Modules/_bsddb.c
index 7b31054..195132e 100644
--- a/Modules/_bsddb.c
+++ b/Modules/_bsddb.c
@@ -425,7 +425,19 @@
return 0;
}
- key->data = PyString_AS_STRING(keyobj);
+ /*
+ * NOTE(gps): I don't like doing a data copy here, it seems
+ * wasteful. But without a clean way to tell FREE_DBT if it
+ * should free key->data or not we have to. Other places in
+ * the code check for DB_THREAD and forceably set DBT_MALLOC
+ * when we otherwise would leave flags 0 to indicate that.
+ */
+ key->data = strdup(PyString_AS_STRING(keyobj));
+ if (key->data == NULL) {
+ PyErr_SetString(PyExc_MemoryError, "Key memory allocation failed");
+ return 0;
+ }
+ key->flags = DB_DBT_REALLOC;
key->size = PyString_GET_SIZE(keyobj);
}