Fix a potential segfault and various potentail refcount leaks

in the cast() function.

diff --git a/Modules/_ctypes/_ctypes.c b/Modules/_ctypes/_ctypes.c
index 18c2db43be249f0f4fa86fb5e7c0b083d75896c2..d26ad1d3e26113ff0dbfbdf3fff3b0892760b7e7 100644 (file)
--- a/Modules/_ctypes/_ctypes.c
+++ b/Modules/_ctypes/_ctypes.c
@@ -4521,32 +4521,30 @@ cast(void *ptr, PyObject *src, PyObject *ctype)
                if (obj->b_objects == Py_None) {
                        Py_DECREF(Py_None);
                        obj->b_objects = PyDict_New();
-                       if (!obj->b_objects) {
-                               Py_DECREF(result);
-                               return NULL;
-                       }
+                       if (obj->b_objects == NULL)
+                               goto failed;
                }
-               /* XXX(nnorwitz): shouldn't the INCREF only be done in an else? */
-               Py_INCREF(obj->b_objects);
                result->b_objects = obj->b_objects;
                if (result->b_objects) {
-                       PyObject *index = PyLong_FromVoidPtr((void *)src);
+                       PyObject *index;
                        int rc;
-                       if (index == NULL) {
-                               Py_DECREF(result);
-                               return NULL;
-                       }
+                       Py_INCREF(obj->b_objects);
+                       index = PyLong_FromVoidPtr((void *)src);
+                       if (index == NULL)
+                               goto failed;
                        rc = PyDict_SetItem(result->b_objects, index, src);
                        Py_DECREF(index);
-                       if (rc == -1) {
-                               Py_DECREF(result);
-                               return NULL;
-                       }
+                       if (rc == -1)
+                               goto failed;
                }
        }
        /* Should we assert that result is a pointer type? */
        memcpy(result->b_ptr, &ptr, sizeof(void *));
        return (PyObject *)result;
+
+  failed:
+       Py_DECREF(result);
+       return NULL;
 }
 
 #ifdef CTYPES_UNICODE