From: Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com>
Date: Sat, 2 Oct 2021 13:21:55 +0000 (-0700)
Subject: bpo-45329: Fix freed memory access in pyexpat.c (GH-28649)
X-Git-Tag: v3.10.1~234
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=22cf6a2f2347b7d4f11e45e557beace55acc79b5;p=thirdparty%2FPython%2Fcpython.git

bpo-45329: Fix freed memory access in pyexpat.c (GH-28649)

(cherry picked from commit 0742abdc48886b74ed3b66985a54bb1c32802670)

Co-authored-by: TAGAMI Yukihiro <tagami.yukihiro@gmail.com>
---

diff --git a/Misc/NEWS.d/next/Library/2021-10-01-13-09-53.bpo-45329.9iMYaO.rst b/Misc/NEWS.d/next/Library/2021-10-01-13-09-53.bpo-45329.9iMYaO.rst
new file mode 100644
index 000000000000..b4bedbc278ed
--- /dev/null
+++ b/Misc/NEWS.d/next/Library/2021-10-01-13-09-53.bpo-45329.9iMYaO.rst
@@ -0,0 +1,2 @@
+Fix freed memory access in :class:`pyexpat.xmlparser` when building it with an
+installed expat library <= 2.2.0.
diff --git a/Modules/pyexpat.c b/Modules/pyexpat.c
index ec684638ead1..b3d9bdda7e7a 100644
--- a/Modules/pyexpat.c
+++ b/Modules/pyexpat.c
@@ -1204,10 +1204,10 @@ static void
 xmlparse_dealloc(xmlparseobject *self)
 {
     PyObject_GC_UnTrack(self);
+    (void)xmlparse_clear(self);
     if (self->itself != NULL)
         XML_ParserFree(self->itself);
     self->itself = NULL;
-    (void)xmlparse_clear(self);
 
     if (self->handlers != NULL) {
         PyMem_Free(self->handlers);