From: Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com>
Date: Fri, 6 May 2022 04:38:14 +0000 (-0700)
Subject: Issues/88027: A potential double free in list_sort_impl (GH-92367)
X-Git-Tag: v3.10.5~92
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=0eef443f0142b8cee705a22d0d1c9df17be94f69;p=thirdparty%2FPython%2Fcpython.git

Issues/88027: A potential double free in list_sort_impl (GH-92367)


merge_freemem(): set keys to NULL do it's harmless to call this again.
(cherry picked from commit 9652900969df77b1ac245595419431df19296af9)

Co-authored-by: Tim Peters <tim.peters@gmail.com>
---

diff --git a/Objects/listobject.c b/Objects/listobject.c
index 533ee7436d31..d3bc5766df7a 100644
--- a/Objects/listobject.c
+++ b/Objects/listobject.c
@@ -1548,8 +1548,10 @@ static void
 merge_freemem(MergeState *ms)
 {
     assert(ms != NULL);
-    if (ms->a.keys != ms->temparray)
+    if (ms->a.keys != ms->temparray) {
         PyMem_Free(ms->a.keys);
+        ms->a.keys = NULL;
+    }
 }
 
 /* Ensure enough temp memory for 'need' array slots is available.