commit 0613c1e481440aa8f54ba7f6056924c175fbcc13
author Zackery Spytz <zspytz@gmail.com> Thu May 09 12:33:32 2019 -0600
committer Petr Viktorin <pviktori@redhat.com> Thu May 09 14:33:31 2019 -0400
tree 7c58edbe03482e817e3e26dd3294b472f88463ad
parent e6576248e5174ca5daa362cfd610c07e7eb3a2ae

Fix a possible crash due to PyType_FromSpecWithBases() (GH-10304)

If the PyObject_MALLOC() call failed in PyType_FromSpecWithBases(),
PyObject_Free() would be called on a static string in type_dealloc().

Objects/typeobject.c

diff --git a/Objects/typeobject.c b/Objects/typeobject.c
index eeaae1f..b28f494 100644
--- a/Objects/typeobject.c
+++ b/Objects/typeobject.c
@@ -2995,6 +2995,7 @@
             size_t len = strlen(old_doc)+1;
             char *tp_doc = PyObject_MALLOC(len);
             if (tp_doc == NULL) {
+                type->tp_doc = NULL;
                 PyErr_NoMemory();
                 goto fail;
             }