Fix a crash: when sq_item failed the code continued blindly and used the
NULL pointer. (Detected by Michael Hudson, patch provided by Neal Norwitz).
Fix refcounting leak in filtertuple().
diff --git a/Python/bltinmodule.c b/Python/bltinmodule.c
index 9f41efc..01771cb 100644
--- a/Python/bltinmodule.c
+++ b/Python/bltinmodule.c
@@ -2174,6 +2174,8 @@
if (tuple->ob_type->tp_as_sequence &&
tuple->ob_type->tp_as_sequence->sq_item) {
item = tuple->ob_type->tp_as_sequence->sq_item(tuple, i);
+ if (item == NULL)
+ goto Fail_1;
} else {
PyErr_SetString(PyExc_TypeError, "filter(): unsubscriptable tuple");
goto Fail_1;
@@ -2184,20 +2186,25 @@
}
else {
PyObject *arg = Py_BuildValue("(O)", item);
- if (arg == NULL)
+ if (arg == NULL) {
+ Py_DECREF(item);
goto Fail_1;
+ }
good = PyEval_CallObject(func, arg);
Py_DECREF(arg);
- if (good == NULL)
+ if (good == NULL) {
+ Py_DECREF(item);
goto Fail_1;
+ }
}
ok = PyObject_IsTrue(good);
Py_DECREF(good);
if (ok) {
- Py_INCREF(item);
if (PyTuple_SetItem(result, j++, item) < 0)
goto Fail_1;
}
+ else
+ Py_DECREF(item);
}
if (_PyTuple_Resize(&result, j) < 0)