In order to fix SF bug # 824977, we replace calloc()/free() calls in

binascii_a2b_qp() and binascii_b2a_qp() with calls to PyMem_Malloc() and
PyMem_Free().  These won't return NULL unless the allocations actually fail,
so it won't trigger a bogus memory error on some platforms <cough>AIX</cough>
when passed a length of zero.

diff --git a/Modules/binascii.c b/Modules/binascii.c
index 05964c9351cc059e699558055b8574882cc17f8c..9cc49f69051cf0938d84a89571e8aa81906195b1 100644 (file)
--- a/Modules/binascii.c
+++ b/Modules/binascii.c
@@ -1036,13 +1036,16 @@ binascii_a2b_qp(PyObject *self, PyObject *args, PyObject *kwargs)
              &datalen, &header))
                return NULL;
 
-       /* We allocate the output same size as input, this is overkill */
-       odata = (unsigned char *) calloc(1, datalen);
-
+       /* We allocate the output same size as input, this is overkill.
+        * The previous implementation used calloc() so we'll zero out the
+        * memory here too, since PyMem_Malloc() does not guarantee that.
+        */
+       odata = (unsigned char *) PyMem_Malloc(datalen);
        if (odata == NULL) {
                PyErr_NoMemory();
                return NULL;
        }
+       memset(odata, datalen, 0);
 
        in = out = 0;
        while (in < datalen) {
@@ -1090,10 +1093,10 @@ binascii_a2b_qp(PyObject *self, PyObject *args, PyObject *kwargs)
                }
        }
        if ((rv = PyString_FromStringAndSize((char *)odata, out)) == NULL) {
-               free (odata);
+               PyMem_Free(odata);
                return NULL;
        }
-       free (odata);
+       PyMem_Free(odata);
        return rv;
 }
 
@@ -1207,12 +1210,16 @@ binascii_b2a_qp (PyObject *self, PyObject *args, PyObject *kwargs)
                }
        }
 
-       odata = (unsigned char *) calloc(1, odatalen);
-
+       /* We allocate the output same size as input, this is overkill.
+        * The previous implementation used calloc() so we'll zero out the
+        * memory here too, since PyMem_Malloc() does not guarantee that.
+        */
+       odata = (unsigned char *) PyMem_Malloc(odatalen);
        if (odata == NULL) {
                PyErr_NoMemory();
                return NULL;
        }
+       memset(odata, odatalen, 0);
 
        in = out = linelen = 0;
        while (in < datalen) {
@@ -1281,10 +1288,10 @@ binascii_b2a_qp (PyObject *self, PyObject *args, PyObject *kwargs)
                }
        }
        if ((rv = PyString_FromStringAndSize((char *)odata, out)) == NULL) {
-               free (odata);
+               PyMem_Free(odata);
                return NULL;
        }
-       free (odata);
+       PyMem_Free(odata);
        return rv;
 }