Backport: Double-fix of crash in Unicode freelist handling.

diff --git a/Misc/NEWS b/Misc/NEWS
index d7b47c7016ef553ea059e85519422badc7ef2911..79bd3ffff13242ea4d4f37ec985f40a8ff7d36f2 100644 (file)
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -12,6 +12,11 @@ What's New in Python 2.3.1?
 Core and builtins
 -----------------
 
+- Fixed a bug in the cache of length-one Unicode strings that could
+  lead to a seg fault.  The specific problem occurred when an earlier,
+  non-fatal error left an uninitialized Unicode object in the
+  freelist.
+
 - Fixed a leak in class objects defining a comparison but not a hash
   function.
 

diff --git a/Objects/unicodeobject.c b/Objects/unicodeobject.c
index 7ba9547b1f747b8f23a663c9cbda8bb72b2c5567..fffab49a35a2386076b4605a408a7a28bbcebc71 100644 (file)
--- a/Objects/unicodeobject.c
+++ b/Objects/unicodeobject.c
@@ -132,7 +132,7 @@ int unicode_resize(register PyUnicodeObject *unicode,
        instead ! */
     if (unicode == unicode_empty || 
        (unicode->length == 1 && 
-        unicode->str[0] < 256 &&
+        unicode->str[0] < 256U &&
         unicode_latin1[unicode->str[0]] == unicode)) {
         PyErr_SetString(PyExc_SystemError,
                         "can't resize shared unicode objects");
@@ -211,6 +211,7 @@ PyUnicodeObject *_PyUnicode_New(int length)
        PyErr_NoMemory();
        goto onError;
     }
+    unicode->str[0] = 0;
     unicode->str[length] = 0;
     unicode->length = length;
     unicode->hash = -1;