Issue #16215: Fix potential double memory free in str.replace().

Patch by Serhiy Storchaka.

diff --git a/Misc/NEWS b/Misc/NEWS
index 217eecd7e187119b24b50e8516ebf487540927c2..b68ead6f9fd4d60ac97818ae2426ae938cf17f5f 100644 (file)
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -12,6 +12,9 @@ What's New in Python 3.3.1?
 Core and Builtins
 -----------------
 
+- Issue #16215: Fix potential double memory free in str.replace().  Patch
+  by Serhiy Storchaka.
+
 - Issue #16453: Fix equality testing of dead weakref objects.
 
 - Issue #9535: Fix pending signals that have been received but not yet

diff --git a/Objects/unicodeobject.c b/Objects/unicodeobject.c
index 665f03d8849d7102f597d035a42e24a1055d9cba..b9ac8343ebcd1fefe6d5b6f01f832d981b0dd03c 100644 (file)
--- a/Objects/unicodeobject.c
+++ b/Objects/unicodeobject.c
@@ -10118,6 +10118,7 @@ replace(PyObject *self, PyObject *str1,
                 /* widen self and buf1 */
                 rkind = kind2;
                 if (release1) PyMem_Free(buf1);
+                release1 = 0;
                 sbuf = _PyUnicode_AsKind(self, rkind);
                 if (!sbuf) goto error;
                 srelease = 1;
@@ -10179,6 +10180,7 @@ replace(PyObject *self, PyObject *str1,
             if (!sbuf) goto error;
             srelease = 1;
             if (release1) PyMem_Free(buf1);
+            release1 = 0;
             buf1 = _PyUnicode_AsKind(str1, rkind);
             if (!buf1) goto error;
             release1 = 1;