Add some missing NULL checks which trigger crashes on low-memory conditions.

Found by Victor Stinner. Will backport when 2.5 branch is unfrozen.

diff --git a/Objects/exceptions.c b/Objects/exceptions.c
index c6ea6a40c4fd82124dfc8b127428d291bfccdc04..65419deba5fde4ad247a844247c1b34711d029b4 100644 (file)
--- a/Objects/exceptions.c
+++ b/Objects/exceptions.c
@@ -33,6 +33,8 @@ BaseException_new(PyTypeObject *type, PyObject *args, PyObject *kwds)
     PyBaseExceptionObject *self;
 
     self = (PyBaseExceptionObject *)type->tp_alloc(type, 0);
+    if (!self)
+        return NULL;
     /* the dict is created on the fly in PyObject_GenericSetAttr */
     self->message = self->dict = NULL;
 

diff --git a/Objects/longobject.c b/Objects/longobject.c
index 6b8d6e4b40f8d3fcb6b6c18e9c883ff040899f3c..6d55354bf6b8a41fc61c5d48fe85af9cdaff8196 100644 (file)
--- a/Objects/longobject.c
+++ b/Objects/longobject.c
@@ -1739,6 +1739,8 @@ long_divrem(PyLongObject *a, PyLongObject *b,
             a->ob_digit[size_a-1] < b->ob_digit[size_b-1])) {
                /* |a| < |b|. */
                *pdiv = _PyLong_New(0);
+               if (*pdiv == NULL)
+                       return -1;
                Py_INCREF(a);
                *prem = (PyLongObject *) a;
                return 0;
@@ -1749,6 +1751,10 @@ long_divrem(PyLongObject *a, PyLongObject *b,
                if (z == NULL)
                        return -1;
                *prem = (PyLongObject *) PyLong_FromLong((long)rem);
+               if (*prem == NULL) {
+                       Py_DECREF(z);
+                       return -1;
+               }
        }
        else {
                z = x_divrem(a, b, prem);
@@ -3204,6 +3210,8 @@ long_coerce(PyObject **pv, PyObject **pw)
 {
        if (PyInt_Check(*pw)) {
                *pw = PyLong_FromLong(PyInt_AS_LONG(*pw));
+               if (*pw == NULL)
+                       return -1;
                Py_INCREF(*pv);
                return 0;
        }