backport tim_one's patch:

Repair widespread misuse of _PyString_Resize.  Since it's clear people
don't understand how this function works, also beefed up the docs.  The
most common usage error is of this form (often spread out across gotos):

	if (_PyString_Resize(&s, n) < 0) {
		Py_DECREF(s);
		s = NULL;
		goto outtahere;
	}

The error is that if _PyString_Resize runs out of memory, it automatically
decrefs the input string object s (which also deallocates it, since its
refcount must be 1 upon entry), and sets s to NULL.  So if the "if"
branch ever triggers, it's an error to call Py_DECREF(s):  s is already
NULL!  A correct way to write the above is the simpler (and intended)

	if (_PyString_Resize(&s, n) < 0)
		goto outtahere;

Bugfix candidate.

Original patch(es):
python/dist/src/Python/bltinmodule.c:2.253

diff --git a/Python/bltinmodule.c b/Python/bltinmodule.c
index 03b941828b99dcb5c31617b08f02713de153044c..d002d5895406df55f2db1e673defaecc78561357 100644 (file)
--- a/Python/bltinmodule.c
+++ b/Python/bltinmodule.c
@@ -2000,8 +2000,8 @@ filterstring(PyObject *func, PyObject *strobj)
                Py_DECREF(item);
        }
 
-       if (j < len && _PyString_Resize(&result, j) < 0)
-               return NULL;
+       if (j < len)
+               _PyString_Resize(&result, j);
 
        return result;