Issue #14909: A number of places were using PyMem_Realloc() apis and
PyObject_GC_Resize() with incorrect error handling. In case of errors,
the original object would be leaked. This checkin fixes those cases.
diff --git a/Modules/_localemodule.c b/Modules/_localemodule.c
index 20c59a4..cc688ba 100644
--- a/Modules/_localemodule.c
+++ b/Modules/_localemodule.c
@@ -257,11 +257,12 @@
n2 = wcsxfrm(buf, s, n1);
if (n2 >= (size_t)n1) {
/* more space needed */
- buf = PyMem_Realloc(buf, (n2+1)*sizeof(wchar_t));
- if (!buf) {
+ wchar_t * new_buf = PyMem_Realloc(buf, (n2+1)*sizeof(wchar_t));
+ if (!new_buf) {
PyErr_NoMemory();
goto exit;
}
+ buf = new_buf;
n2 = wcsxfrm(buf, s, n2+1);
}
result = PyUnicode_FromWideChar(buf, n2);
diff --git a/Modules/_randommodule.c b/Modules/_randommodule.c
index bc9b04a..3c7d700 100644
--- a/Modules/_randommodule.c
+++ b/Modules/_randommodule.c
@@ -210,7 +210,7 @@
PyObject *masklower = NULL;
PyObject *thirtytwo = NULL;
PyObject *n = NULL;
- unsigned long *key = NULL;
+ unsigned long *new_key, *key = NULL;
unsigned long keymax; /* # of allocated slots in key */
unsigned long keyused; /* # of used slots in key */
int err;
@@ -287,10 +287,11 @@
PyErr_NoMemory();
goto Done;
}
- key = (unsigned long *)PyMem_Realloc(key,
+ new_key = (unsigned long *)PyMem_Realloc(key,
bigger * sizeof(*key));
- if (key == NULL)
+ if (new_key == NULL)
goto Done;
+ key = new_key;
keymax = bigger;
}
assert(keyused < keymax);
diff --git a/Modules/unicodedata.c b/Modules/unicodedata.c
index ed79165..5c982f5 100644
--- a/Modules/unicodedata.c
+++ b/Modules/unicodedata.c
@@ -526,13 +526,16 @@
/* Hangul Decomposition adds three characters in
a single step, so we need atleast that much room. */
if (space < 3) {
+ Py_UCS4 *new_output;
osize += 10;
space += 10;
- output = PyMem_Realloc(output, osize*sizeof(Py_UCS4));
- if (output == NULL) {
+ new_output = PyMem_Realloc(output, osize*sizeof(Py_UCS4));
+ if (new_output == NULL) {
+ PyMem_Free(output);
PyErr_NoMemory();
return NULL;
}
+ output = new_output;
}
/* Hangul Decomposition. */
if (SBase <= code && code < (SBase+SCount)) {
diff --git a/Objects/frameobject.c b/Objects/frameobject.c
index 6208556..929385f 100644
--- a/Objects/frameobject.c
+++ b/Objects/frameobject.c
@@ -663,11 +663,13 @@
f = free_list;
free_list = free_list->f_back;
if (Py_SIZE(f) < extras) {
- f = PyObject_GC_Resize(PyFrameObject, f, extras);
- if (f == NULL) {
+ PyFrameObject *new_f = PyObject_GC_Resize(PyFrameObject, f, extras);
+ if (new_f == NULL) {
+ PyObject_GC_Del(f);
Py_DECREF(builtins);
return NULL;
}
+ f = new_f;
}
_Py_NewReference((PyObject *)f);
}
diff --git a/Objects/unicodeobject.c b/Objects/unicodeobject.c
index 874e80e..9e9378e 100644
--- a/Objects/unicodeobject.c
+++ b/Objects/unicodeobject.c
@@ -8343,13 +8343,15 @@
Py_ssize_t requiredsize)
{
Py_ssize_t oldsize = *psize;
+ Py_UCS4 *new_outobj;
if (requiredsize > oldsize) {
/* exponentially overallocate to minimize reallocations */
if (requiredsize < 2 * oldsize)
requiredsize = 2 * oldsize;
- *outobj = PyMem_Realloc(*outobj, requiredsize * sizeof(Py_UCS4));
- if (*outobj == 0)
+ new_outobj = PyMem_Realloc(*outobj, requiredsize * sizeof(Py_UCS4));
+ if (new_outobj == 0)
return -1;
+ *outobj = new_outobj;
*psize = requiredsize;
}
return 0;