From: Zackery Spytz <zspytz@gmail.com>
Date: Thu, 9 May 2019 18:33:32 +0000 (-0600)
Subject: Fix a possible crash due to PyType_FromSpecWithBases() (GH-10304)
X-Git-Tag: v3.8.0b1~429
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=0613c1e481440aa8f54ba7f6056924c175fbcc13;p=thirdparty%2FPython%2Fcpython.git

Fix a possible crash due to PyType_FromSpecWithBases() (GH-10304)

If the PyObject_MALLOC() call failed in PyType_FromSpecWithBases(),
PyObject_Free() would be called on a static string in type_dealloc().
---

diff --git a/Objects/typeobject.c b/Objects/typeobject.c
index eeaae1f9f789..b28f494962ec 100644
--- a/Objects/typeobject.c
+++ b/Objects/typeobject.c
@@ -2995,6 +2995,7 @@ PyType_FromSpecWithBases(PyType_Spec *spec, PyObject *bases)
             size_t len = strlen(old_doc)+1;
             char *tp_doc = PyObject_MALLOC(len);
             if (tp_doc == NULL) {
+                type->tp_doc = NULL;
                 PyErr_NoMemory();
                 goto fail;
             }