Issues/88027: A potential double free in list_sort_impl (GH-92367)

merge_freemem(): set keys to NULL do it's harmless to call this again.
(cherry picked from commit 9652900969df77b1ac245595419431df19296af9)

Co-authored-by: Tim Peters <tim.peters@gmail.com>

diff --git a/Objects/listobject.c b/Objects/listobject.c
index 533ee7436d31133e3ba3be94eb268560f18926fb..d3bc5766df7a0bea82f08e1b69ac0f9b8a255731 100644 (file)
--- a/Objects/listobject.c
+++ b/Objects/listobject.c
@@ -1548,8 +1548,10 @@ static void
 merge_freemem(MergeState *ms)
 {
     assert(ms != NULL);
-    if (ms->a.keys != ms->temparray)
+    if (ms->a.keys != ms->temparray) {
         PyMem_Free(ms->a.keys);
+        ms->a.keys = NULL;
+    }
 }
 
 /* Ensure enough temp memory for 'need' array slots is available.