Backport trunk's r42878 (neal.norwitz):

Thanks to Coverity, these were all reported by their Prevent tool.

and r42881 (thomas.wouters):

Don't DECREF a borrowed reference.

diff --git a/Lib/test/test_hotshot.py b/Lib/test/test_hotshot.py
index 721da57f1f7395f0616e9e51d8ea8f99a9c2f2cb..4618439867d748ba23e67a0deb1ace921eb91833 100644 (file)
--- a/Lib/test/test_hotshot.py
+++ b/Lib/test/test_hotshot.py
@@ -107,6 +107,19 @@ class HotShotTestCase(unittest.TestCase):
         profiler.close()
         os.unlink(self.logfn)
 
+    def test_bad_sys_path(self):
+        import sys
+        orig_path = sys.path
+        coverage = hotshot._hotshot.coverage
+        try:
+            # verify we require a list for sys.path
+            sys.path = 'abc'
+            self.assertRaises(RuntimeError, coverage, test_support.TESTFN)
+            # verify sys.path exists
+            del sys.path
+            self.assertRaises(RuntimeError, coverage, test_support.TESTFN)
+        finally:
+            sys.path = orig_path
 
 def test_main():
     test_support.run_unittest(HotShotTestCase)

diff --git a/Modules/_hotshot.c b/Modules/_hotshot.c
index b75b1a32fbd88e69b56c8c5d83ff170d4d781b44..f3128e080debe7433dc99379103ce2e4ea5e7260 100644 (file)
--- a/Modules/_hotshot.c
+++ b/Modules/_hotshot.c
@@ -473,6 +473,8 @@ restart:
     }
     else if (!err) {
         result = PyTuple_New(4);
+        if (result == NULL)
+            return NULL;
         PyTuple_SET_ITEM(result, 0, PyInt_FromLong(what));
         PyTuple_SET_ITEM(result, 2, PyInt_FromLong(fileno));
         if (s1 == NULL)
@@ -1486,6 +1488,10 @@ write_header(ProfilerObject *self)
                   getcwd(cwdbuffer, sizeof cwdbuffer));
 
     temp = PySys_GetObject("path");
+    if (temp == NULL || !PyList_Check(temp)) {
+        PyErr_SetString(PyExc_RuntimeError, "sys.path must be a list");
+        return -1;
+    }
     len = PyList_GET_SIZE(temp);
     for (i = 0; i < len; ++i) {
         PyObject *item = PyList_GET_ITEM(temp, i);

diff --git a/Modules/_sre.c b/Modules/_sre.c
index f97cb62761a52f6f20486d0f2d5d2c950d8de647..327f54a7e9c653f397f32b17c6cb90ed02c37277 100644 (file)
--- a/Modules/_sre.c
+++ b/Modules/_sre.c
@@ -2980,7 +2980,7 @@ match_groupdict(MatchObject* self, PyObject* args, PyObject* kw)
     return result;
 
 failed:
-    Py_DECREF(keys);
+    Py_XDECREF(keys);
     Py_DECREF(result);
     return NULL;
 }

diff --git a/Modules/audioop.c b/Modules/audioop.c
index 52824b84b6943adc7db6909a70086c686765854d..023d22b238e28a94eeaaa5e338ed12eeb625416c 100644 (file)
--- a/Modules/audioop.c
+++ b/Modules/audioop.c
@@ -1013,6 +1013,8 @@ audioop_ratecv(PyObject *self, PyObject *args)
                while (d < 0) {
                        if (len == 0) {
                                samps = PyTuple_New(nchannels);
+                               if (samps == NULL)
+                                       goto exit;
                                for (chan = 0; chan < nchannels; chan++)
                                        PyTuple_SetItem(samps, chan,
                                                Py_BuildValue("(ii)",

diff --git a/Modules/regexmodule.c b/Modules/regexmodule.c
index 9f84032e4d46377c453bf3edc6ce1a2baeb3227c..f75e9b20ef7aae83fc1dd7e72c9c3db4bf7ea2db 100644 (file)
--- a/Modules/regexmodule.c
+++ b/Modules/regexmodule.c
@@ -535,8 +535,7 @@ regex_symcomp(PyObject *self, PyObject *args)
 
        gdict = PyDict_New();
        if (gdict == NULL || (npattern = symcomp(pattern, gdict)) == NULL) {
-               Py_DECREF(gdict);
-               Py_DECREF(pattern);
+               Py_XDECREF(gdict);
                return NULL;
        }
        retval = newregexobject(npattern, tran, pattern, gdict);