Fix in PyList_New(). With GC enabled and when out of memory,

free() the GC pointer, not the object pointer.

diff --git a/Objects/listobject.c b/Objects/listobject.c
index e85e2f49bf2f688b6a994e40b5b84164731ca37f..52640fb0837795d43f25fe6d058e21610b16de54 100644 (file)
--- a/Objects/listobject.c
+++ b/Objects/listobject.c
@@ -60,7 +60,7 @@ PyList_New(int size)
        else {
                op->ob_item = (PyObject **) PyMem_MALLOC(nbytes);
                if (op->ob_item == NULL) {
-                       PyObject_FREE(op);
+                       PyObject_FREE(PyObject_AS_GC(op));
                        return PyErr_NoMemory();
                }
        }