From: Walter Dörwald <walter@livinglogic.de>
Date: Mon, 18 Aug 2003 18:34:09 +0000 (+0000)
Subject: Backport checkin:
X-Git-Tag: v2.3.1~141
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=afa2448b2ae035aab0898361ed89881aef9b80a1;p=thirdparty%2FPython%2Fcpython.git

Backport checkin:

Fix a crash: when sq_item failed the code continued blindly and used the
NULL pointer. (Detected by Michael Hudson, patch provided by Neal Norwitz).

Fix refcounting leak in filtertuple().
---

diff --git a/Python/bltinmodule.c b/Python/bltinmodule.c
index 49fcc09cfc04..e10d16ba65f4 100644
--- a/Python/bltinmodule.c
+++ b/Python/bltinmodule.c
@@ -2176,6 +2176,8 @@ filtertuple(PyObject *func, PyObject *tuple)
 		if (tuple->ob_type->tp_as_sequence &&
 		    tuple->ob_type->tp_as_sequence->sq_item) {
 			item = tuple->ob_type->tp_as_sequence->sq_item(tuple, i);
+			if (item == NULL)
+				goto Fail_1;
 		} else {
 			PyErr_SetString(PyExc_TypeError, "filter(): unsubscriptable tuple");
 			goto Fail_1;
@@ -2186,20 +2188,25 @@ filtertuple(PyObject *func, PyObject *tuple)
 		}
 		else {
 			PyObject *arg = Py_BuildValue("(O)", item);
-			if (arg == NULL)
+			if (arg == NULL) {
+				Py_DECREF(item);
 				goto Fail_1;
+			}
 			good = PyEval_CallObject(func, arg);
 			Py_DECREF(arg);
-			if (good == NULL)
+			if (good == NULL) {
+				Py_DECREF(item);
 				goto Fail_1;
+			}
 		}
 		ok = PyObject_IsTrue(good);
 		Py_DECREF(good);
 		if (ok) {
-			Py_INCREF(item);
 			if (PyTuple_SetItem(result, j++, item) < 0)
 				goto Fail_1;
 		}
+		else
+			Py_DECREF(item);
 	}
 
 	if (_PyTuple_Resize(&result, j) < 0)