From: Victor Stinner <vstinner@redhat.com>
Date: Wed, 20 Mar 2019 12:03:41 +0000 (+0100)
Subject: bpo-36367: Free buffer if realloc fails in tokenize.c (GH-12442) (GH-12470)
X-Git-Tag: v2.7.17rc1~110
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=469b0a50d990bcb441910b23194c131e403c2833;p=thirdparty%2FPython%2Fcpython.git

bpo-36367: Free buffer if realloc fails in tokenize.c (GH-12442) (GH-12470)

(cherry picked from commit cb90c89de14aab636739b3e810cf949e47b54a0c)
---

diff --git a/Parser/tokenizer.c b/Parser/tokenizer.c
index c6e61df533e2..6d7869c88e22 100644
--- a/Parser/tokenizer.c
+++ b/Parser/tokenizer.c
@@ -656,9 +656,14 @@ translate_newlines(const char *s, int exec_input, struct tok_state *tok) {
     }
     *current = '\0';
     final_length = current - buf + 1;
-    if (final_length < needed_length && final_length)
+    if (final_length < needed_length && final_length) {
         /* should never fail */
-        buf = PyMem_REALLOC(buf, final_length);
+        char* result = PyMem_REALLOC(buf, final_length);
+        if (result == NULL) {
+            PyMem_FREE(buf);
+        }
+        buf = result;
+    }
     return buf;
 }
 
@@ -974,6 +979,7 @@ tok_nextc(register struct tok_state *tok)
                 newbuf = (char *)PyMem_REALLOC(newbuf,
                                                newsize);
                 if (newbuf == NULL) {
+                    PyMem_FREE(tok->buf);
                     tok->done = E_NOMEM;
                     tok->cur = tok->inp;
                     return EOF;