backporting fix by tim_one:

"""
SF bug #1238681:  freed pointer is used in longobject.c:long_pow().

In addition, long_pow() skipped a necessary (albeit extremely unlikely
to trigger) error check when converting an int modulus to long.

Alas, I was unable to write a test case that crashed due to either
cause.
"""

diff --git a/Misc/NEWS b/Misc/NEWS
index 875c148a91cf26ad36d054b87b70bd6fbafc4dce..fff4715a059334881f8e837462ceff8d9f768d23 100644 (file)
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -12,6 +12,8 @@ What's New in Python 2.4.2a
 Core and builtins
 -----------------
 
+- SF bug #1238681:  freed pointer is used in longobject.c:long_pow().
+
 - SF bug #1185883:  Python's small-object memory allocator took over
   a block managed by the platform C library whenever a realloc specified
   a small new size.  However, there's no portable way to know then how

diff --git a/Objects/longobject.c b/Objects/longobject.c
index 11a7024e4543eda49e84b8f7bfe7bc7062d530b4..ced72e108b3ef05f5e39829b4e6130eba8080045 100644 (file)
--- a/Objects/longobject.c
+++ b/Objects/longobject.c
@@ -2360,8 +2360,11 @@ long_pow(PyObject *v, PyObject *w, PyObject *x)
                c = (PyLongObject *)x;
                Py_INCREF(x);
        }
-       else if (PyInt_Check(x))
+       else if (PyInt_Check(x)) {
                c = (PyLongObject *)PyLong_FromLong(PyInt_AS_LONG(x));
+               if (c == NULL)
+                       goto Error;
+       }
        else if (x == Py_None)
                c = NULL;
        else {
@@ -2511,14 +2514,14 @@ long_pow(PyObject *v, PyObject *w, PyObject *x)
        }
        /* fall through */
  Done:
-       Py_XDECREF(a);
-       Py_XDECREF(b);
-       Py_XDECREF(c);
-       Py_XDECREF(temp);
        if (b->ob_size > FIVEARY_CUTOFF) {
                for (i = 0; i < 32; ++i)
                        Py_XDECREF(table[i]);
        }
+       Py_DECREF(a);
+       Py_DECREF(b);
+       Py_XDECREF(c);
+       Py_XDECREF(temp);
        return (PyObject *)z;
 }