Fix a couple of crashing-on-malformed data marshal bugs.

diff --git a/Python/marshal.c b/Python/marshal.c
index 2535cb5514ff48fef611dc281a8aaff86da0fedc..59aabacabf4dfb649d393bfdb58402425c3050ef 100644 (file)
--- a/Python/marshal.c
+++ b/Python/marshal.c
@@ -632,13 +632,13 @@ r_object(RFILE *p)
                        return NULL;
                }
                v = PyString_FromStringAndSize((char *)NULL, n);
-               if (v != NULL) {
-                       if (r_string(PyString_AS_STRING(v), (int)n, p) != n) {
-                               Py_DECREF(v);
-                               v = NULL;
-                               PyErr_SetString(PyExc_EOFError,
+               if (v == NULL)
+                       return v;
+               if (r_string(PyString_AS_STRING(v), (int)n, p) != n) {
+                       Py_DECREF(v);
+                       PyErr_SetString(PyExc_EOFError,
                                        "EOF read where object expected");
-                       }
+                       return NULL;
                }
                if (type == TYPE_INTERNED) {
                        PyString_InternInPlace(&v);
@@ -766,6 +766,8 @@ r_object(RFILE *p)
                        }
                        PyTuple_SET_ITEM(v, (int)i, v2);
                }
+               if (v == NULL)
+                       return v;
                if (type == TYPE_SET)
                        v3 = PyObject_CallFunctionObjArgs(
                                (PyObject *)&PySet_Type, v, NULL);