SF bug #1238681: freed pointer is used in longobject.c:long_pow().
In addition, long_pow() skipped a necessary (albeit extremely unlikely
to trigger) error check when converting an int modulus to long.
Alas, I was unable to write a test case that crashed due to either
cause.
Bugfix candidate.
diff --git a/Misc/NEWS b/Misc/NEWS
index 89583e0..27d2763 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -12,6 +12,8 @@
Core and builtins
-----------------
+- SF bug #1238681: freed pointer is used in longobject.c:long_pow().
+
- SF bug #1229429: PyObject_CallMethod failed to decrement some
reference counts in some error exit cases.
diff --git a/Objects/longobject.c b/Objects/longobject.c
index 1f328dd..ff5ba6f 100644
--- a/Objects/longobject.c
+++ b/Objects/longobject.c
@@ -2360,8 +2360,11 @@
c = (PyLongObject *)x;
Py_INCREF(x);
}
- else if (PyInt_Check(x))
+ else if (PyInt_Check(x)) {
c = (PyLongObject *)PyLong_FromLong(PyInt_AS_LONG(x));
+ if (c == NULL)
+ goto Error;
+ }
else if (x == Py_None)
c = NULL;
else {
@@ -2511,14 +2514,14 @@
}
/* fall through */
Done:
- Py_XDECREF(a);
- Py_XDECREF(b);
- Py_XDECREF(c);
- Py_XDECREF(temp);
if (b->ob_size > FIVEARY_CUTOFF) {
for (i = 0; i < 32; ++i)
Py_XDECREF(table[i]);
}
+ Py_DECREF(a);
+ Py_DECREF(b);
+ Py_XDECREF(c);
+ Py_XDECREF(temp);
return (PyObject *)z;
}