http://bugs.python.org/issue6836
A memory block allocated with one API was being handed over to an object that used another API to release it.
diff --git a/Parser/parsetok.c b/Parser/parsetok.c
index 71792dd..3994add 100644
--- a/Parser/parsetok.c
+++ b/Parser/parsetok.c
@@ -243,16 +243,24 @@
err_ret->text = text;
}
} else if (tok->encoding != NULL) {
+ /* 'nodes->n_str' uses PyObject_*, while 'tok->encoding' was
+ * allocated using PyMem_
+ */
node* r = PyNode_New(encoding_decl);
- if (!r) {
+ if (r)
+ r->n_str = PyObject_MALLOC(strlen(tok->encoding)+1);
+ if (!r || !r->n_str) {
err_ret->error = E_NOMEM;
+ if (r)
+ PyObject_FREE(r);
n = NULL;
goto done;
}
- r->n_str = tok->encoding;
+ strcpy(r->n_str, tok->encoding);
+ PyMem_FREE(tok->encoding);
+ tok->encoding = NULL;
r->n_nchildren = 1;
r->n_child = n;
- tok->encoding = NULL;
n = r;
}