Fix a crash: when sq_item failed the code continued blindly and used the

NULL pointer. (Detected by Michael Hudson, patch provided by Neal Norwitz).

Fix refcounting leak in filtertuple().

diff --git a/Python/bltinmodule.c b/Python/bltinmodule.c
index 9f41efcb55c8af7c91648fd9f98c4f6eb08d4bc1..01771cbc72dc40039b2b896a552be22a444f0e1f 100644 (file)
--- a/Python/bltinmodule.c
+++ b/Python/bltinmodule.c
@@ -2174,6 +2174,8 @@ filtertuple(PyObject *func, PyObject *tuple)
                if (tuple->ob_type->tp_as_sequence &&
                    tuple->ob_type->tp_as_sequence->sq_item) {
                        item = tuple->ob_type->tp_as_sequence->sq_item(tuple, i);
+                       if (item == NULL)
+                               goto Fail_1;
                } else {
                        PyErr_SetString(PyExc_TypeError, "filter(): unsubscriptable tuple");
                        goto Fail_1;
@@ -2184,20 +2186,25 @@ filtertuple(PyObject *func, PyObject *tuple)
                }
                else {
                        PyObject *arg = Py_BuildValue("(O)", item);
-                       if (arg == NULL)
+                       if (arg == NULL) {
+                               Py_DECREF(item);
                                goto Fail_1;
+                       }
                        good = PyEval_CallObject(func, arg);
                        Py_DECREF(arg);
-                       if (good == NULL)
+                       if (good == NULL) {
+                               Py_DECREF(item);
                                goto Fail_1;
+                       }
                }
                ok = PyObject_IsTrue(good);
                Py_DECREF(good);
                if (ok) {
-                       Py_INCREF(item);
                        if (PyTuple_SetItem(result, j++, item) < 0)
                                goto Fail_1;
                }
+               else
+                       Py_DECREF(item);
        }
 
        if (_PyTuple_Resize(&result, j) < 0)