Thanks to Coverity, these were all reported by their Prevent tool.

All of these (except _lsprof.c) should be backported.  Particularly
the hotshot change which validates sys.path.  Can someone backport?

diff --git a/Lib/test/test_hotshot.py b/Lib/test/test_hotshot.py
index 721da57f1f7395f0616e9e51d8ea8f99a9c2f2cb..4618439867d748ba23e67a0deb1ace921eb91833 100644 (file)
--- a/Lib/test/test_hotshot.py
+++ b/Lib/test/test_hotshot.py
@@ -107,6 +107,19 @@ class HotShotTestCase(unittest.TestCase):
         profiler.close()
         os.unlink(self.logfn)
 
+    def test_bad_sys_path(self):
+        import sys
+        orig_path = sys.path
+        coverage = hotshot._hotshot.coverage
+        try:
+            # verify we require a list for sys.path
+            sys.path = 'abc'
+            self.assertRaises(RuntimeError, coverage, test_support.TESTFN)
+            # verify sys.path exists
+            del sys.path
+            self.assertRaises(RuntimeError, coverage, test_support.TESTFN)
+        finally:
+            sys.path = orig_path
 
 def test_main():
     test_support.run_unittest(HotShotTestCase)

diff --git a/Modules/_hotshot.c b/Modules/_hotshot.c
index 162a3197445e1fc8e086624625312b0f88d91b54..64dfa9130177e5df8928c9ec8f45ad828b0d1173 100644 (file)
--- a/Modules/_hotshot.c
+++ b/Modules/_hotshot.c
@@ -473,6 +473,8 @@ restart:
     }
     else if (!err) {
         result = PyTuple_New(4);
+        if (result == NULL)
+            return NULL;
         PyTuple_SET_ITEM(result, 0, PyInt_FromLong(what));
         PyTuple_SET_ITEM(result, 2, PyInt_FromLong(fileno));
         if (s1 == NULL)
@@ -1455,6 +1457,10 @@ write_header(ProfilerObject *self)
                   getcwd(cwdbuffer, sizeof cwdbuffer));
 
     temp = PySys_GetObject("path");
+    if (temp == NULL || !PyList_Check(temp)) {
+       PyErr_SetString(PyExc_RuntimeError, "sys.path must be a list");
+       return -1;
+    }
     len = PyList_GET_SIZE(temp);
     for (i = 0; i < len; ++i) {
         PyObject *item = PyList_GET_ITEM(temp, i);

diff --git a/Modules/_lsprof.c b/Modules/_lsprof.c
index 8ffdf238a11c5a30b1b347ba4099728d8ab8494f..dddab8ea1a92e566922bc4a6783a69bd503702a5 100644 (file)
--- a/Modules/_lsprof.c
+++ b/Modules/_lsprof.c
@@ -850,6 +850,8 @@ init_lsprof(void)
 {
        PyObject *module, *d;
        module = Py_InitModule3("_lsprof", moduleMethods, "Fast profiler");
+       if (module == NULL)
+               return;
        d = PyModule_GetDict(module);
        if (PyType_Ready(&PyProfiler_Type) < 0)
                return;

diff --git a/Modules/_sre.c b/Modules/_sre.c
index fb73f7fbd6bfde0939a086853fbb492510a0bcec..413ae09af5057fe6f430b03ce9a5d6388f0a542a 100644 (file)
--- a/Modules/_sre.c
+++ b/Modules/_sre.c
@@ -2983,7 +2983,7 @@ match_groupdict(MatchObject* self, PyObject* args, PyObject* kw)
     return result;
 
 failed:
-    Py_DECREF(keys);
+    Py_XDECREF(keys);
     Py_DECREF(result);
     return NULL;
 }

diff --git a/Modules/audioop.c b/Modules/audioop.c
index 5e285f41f2e869061a26f9475289a8805485c869..beeacd3491a346b50ac5c9a255efae3e85b69dfa 100644 (file)
--- a/Modules/audioop.c
+++ b/Modules/audioop.c
@@ -1013,6 +1013,8 @@ audioop_ratecv(PyObject *self, PyObject *args)
                while (d < 0) {
                        if (len == 0) {
                                samps = PyTuple_New(nchannels);
+                               if (samps == NULL)
+                                       goto exit;
                                for (chan = 0; chan < nchannels; chan++)
                                        PyTuple_SetItem(samps, chan,
                                                Py_BuildValue("(ii)",

diff --git a/Modules/regexmodule.c b/Modules/regexmodule.c
index d44993262ea6b67163504300a4caf3b3111bfe4a..fe4cc9a073bf368dd364c0d5948c0599e37ff4cb 100644 (file)
--- a/Modules/regexmodule.c
+++ b/Modules/regexmodule.c
@@ -535,7 +535,7 @@ regex_symcomp(PyObject *self, PyObject *args)
 
        gdict = PyDict_New();
        if (gdict == NULL || (npattern = symcomp(pattern, gdict)) == NULL) {
-               Py_DECREF(gdict);
+               Py_XDECREF(gdict);
                Py_DECREF(pattern);
                return NULL;
        }