Issues/88027: A potential double free in list_sort_impl (#92367)

merge_freemem(): set keys to NULL do it's harmless to call this again.

diff --git a/Objects/listobject.c b/Objects/listobject.c
index 972f99582163bac8520ef148fced03f2e2f65e9f..b50623ed73d94005ca0e12edadfcb6f012ba703e 100644 (file)
--- a/Objects/listobject.c
+++ b/Objects/listobject.c
@@ -1573,8 +1573,10 @@ static void
 merge_freemem(MergeState *ms)
 {
     assert(ms != NULL);
-    if (ms->a.keys != ms->temparray)
+    if (ms->a.keys != ms->temparray) {
         PyMem_Free(ms->a.keys);
+        ms->a.keys = NULL;
+    }
 }
 
 /* Ensure enough temp memory for 'need' array slots is available.