Issue #18552: Check return value of PyArena_AddPyObject() in obj2ast_object().
diff --git a/Misc/NEWS b/Misc/NEWS
index 769b80e..ff6fe06 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -12,6 +12,9 @@
Core and Builtins
-----------------
+- Issue #18552: Check return value of PyArena_AddPyObject() in
+ obj2ast_object().
+
- Issue #18560: Fix potential NULL pointer dereference in sum().
- Issue #15905: Fix theoretical buffer overflow in handling of sys.argv[0],
diff --git a/Parser/asdl_c.py b/Parser/asdl_c.py
index 2568222..e61aae2 100755
--- a/Parser/asdl_c.py
+++ b/Parser/asdl_c.py
@@ -834,9 +834,13 @@
{
if (obj == Py_None)
obj = NULL;
- if (obj)
- PyArena_AddPyObject(arena, obj);
- Py_XINCREF(obj);
+ if (obj) {
+ if (PyArena_AddPyObject(arena, obj) < 0) {
+ *out = NULL;
+ return -1;
+ }
+ Py_INCREF(obj);
+ }
*out = obj;
return 0;
}
diff --git a/Python/Python-ast.c b/Python/Python-ast.c
index d78657c..7bf2c50 100644
--- a/Python/Python-ast.c
+++ b/Python/Python-ast.c
@@ -688,9 +688,13 @@
{
if (obj == Py_None)
obj = NULL;
- if (obj)
- PyArena_AddPyObject(arena, obj);
- Py_XINCREF(obj);
+ if (obj) {
+ if (PyArena_AddPyObject(arena, obj) < 0) {
+ *out = NULL;
+ return -1;
+ }
+ Py_INCREF(obj);
+ }
*out = obj;
return 0;
}