Backport checkin:

Fix a crash: when sq_item failed the code continued blindly and used the
NULL pointer. (Detected by Michael Hudson, patch provided by Neal Norwitz).

Fix refcounting leak in filtertuple().

diff --git a/Python/bltinmodule.c b/Python/bltinmodule.c
index 49fcc09cfc04a1cfab40a31fabcbaf04b3616f02..e10d16ba65f416742f4c5828ffec838bbd7977f6 100644 (file)
--- a/Python/bltinmodule.c
+++ b/Python/bltinmodule.c
@@ -2176,6 +2176,8 @@ filtertuple(PyObject *func, PyObject *tuple)
                if (tuple->ob_type->tp_as_sequence &&
                    tuple->ob_type->tp_as_sequence->sq_item) {
                        item = tuple->ob_type->tp_as_sequence->sq_item(tuple, i);
+                       if (item == NULL)
+                               goto Fail_1;
                } else {
                        PyErr_SetString(PyExc_TypeError, "filter(): unsubscriptable tuple");
                        goto Fail_1;
@@ -2186,20 +2188,25 @@ filtertuple(PyObject *func, PyObject *tuple)
                }
                else {
                        PyObject *arg = Py_BuildValue("(O)", item);
-                       if (arg == NULL)
+                       if (arg == NULL) {
+                               Py_DECREF(item);
                                goto Fail_1;
+                       }
                        good = PyEval_CallObject(func, arg);
                        Py_DECREF(arg);
-                       if (good == NULL)
+                       if (good == NULL) {
+                               Py_DECREF(item);
                                goto Fail_1;
+                       }
                }
                ok = PyObject_IsTrue(good);
                Py_DECREF(good);
                if (ok) {
-                       Py_INCREF(item);
                        if (PyTuple_SetItem(result, j++, item) < 0)
                                goto Fail_1;
                }
+               else
+                       Py_DECREF(item);
        }
 
        if (_PyTuple_Resize(&result, j) < 0)