fix issue2858: potential memory corruption when any of the bsddb.db.*

constructors raised an exception.  backportes from trunk c63403.

diff --git a/Misc/NEWS b/Misc/NEWS
index e53f02be7263ae4500d413bbc3ae548db40bd36a..f7d732717c699dfc778584a6ce41acadf6c36454 100644 (file)
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -89,6 +89,9 @@ Extension Modules
 - zlib.decompressobj().flush(value) no longer crashes the interpreter when
   passed a value less than or equal to zero.
 
+- issue2858: Fix potential memory corruption when bsddb.db.DBEnv.lock_get
+  and other bsddb.db object constructors raised an exception.
+
 Tests
 -----
 

diff --git a/Modules/_bsddb.c b/Modules/_bsddb.c
index 4cedc98d7b15c717a647fff28b804ebde9fcf5c8..9c9a6b3477f9c9efc00626e7a3f8fb5be4d63e8c 100644 (file)
--- a/Modules/_bsddb.c
+++ b/Modules/_bsddb.c
@@ -834,7 +834,7 @@ newDBObject(DBEnvObject* arg, int flags)
             Py_DECREF(self->myenvobj);
             self->myenvobj = NULL;
         }
-        PyObject_Del(self);
+        Py_DECREF(self);
         self = NULL;
     }
     return self;
@@ -955,7 +955,7 @@ newDBEnvObject(int flags)
     err = db_env_create(&self->db_env, flags);
     MYDB_END_ALLOW_THREADS;
     if (makeDBError(err)) {
-        PyObject_Del(self);
+        Py_DECREF(self);
         self = NULL;
     }
     else {
@@ -1004,8 +1004,7 @@ newDBTxnObject(DBEnvObject* myenv, DB_TXN *parent, int flags)
 #endif
     MYDB_END_ALLOW_THREADS;
     if (makeDBError(err)) {
-        Py_DECREF(self->env);
-        PyObject_Del(self);
+        Py_DECREF(self);
         self = NULL;
     }
     return self;
@@ -1062,7 +1061,7 @@ newDBLockObject(DBEnvObject* myenv, u_int32_t locker, DBT* obj,
 #endif
     MYDB_END_ALLOW_THREADS;
     if (makeDBError(err)) {
-        PyObject_Del(self);
+        Py_DECREF(self);
         self = NULL;
     }
 
@@ -1103,8 +1102,7 @@ newDBSequenceObject(DBObject* mydb,  int flags)
     err = db_sequence_create(&self->sequence, self->mydb->db, flags);
     MYDB_END_ALLOW_THREADS;
     if (makeDBError(err)) {
-        Py_DECREF(self->mydb);
-        PyObject_Del(self);
+        Py_DECREF(self);
         self = NULL;
     }