Fix problems found by Coverity.

longobject.c: also fix an ssize_t problem
  <a> could have been NULL, so hoist the size calc to not use <a>.

_ssl.c: under fail: self is DECREF'd, but it would have been NULL.

_elementtree.c: delete self if there was an error.

_csv.c: I'm not sure if lineterminator could have been anything other than
a string.  However, other string method calls are checked, so check this
one too.

diff --git a/Modules/_csv.c b/Modules/_csv.c
index 67d5d9f8fb00361088864ba8ba8e8f51c78090df..5e036355977a7615c2cfde7ca0c52c6a215b8690 100644 (file)
--- a/Modules/_csv.c
+++ b/Modules/_csv.c
@@ -1104,6 +1104,8 @@ join_append_lineterminator(WriterObj *self)
        char *terminator;
 
        terminator_len = PyString_Size(self->dialect->lineterminator);
+       if (terminator_len == -1)
+               return 0;
 
        /* grow record buffer if necessary */
        if (!join_check_rec_size(self, self->rec_len + terminator_len))

diff --git a/Modules/_elementtree.c b/Modules/_elementtree.c
index 06ae24c37cc6a02e97e669b0f507c6f3268929c1..3dd5c2608adb8041ee0965ee1471056ee9c72eb3 100644 (file)
--- a/Modules/_elementtree.c
+++ b/Modules/_elementtree.c
@@ -327,8 +327,10 @@ element_new(PyObject* tag, PyObject* attrib)
 
     if (attrib != Py_None) {
 
-        if (element_new_extra(self, attrib) < 0)
+        if (element_new_extra(self, attrib) < 0) {
+            PyObject_Del(self);
             return NULL;
+       }
 
         self->extra->length = 0;
         self->extra->allocated = STATIC_CHILDREN;

diff --git a/Modules/_ssl.c b/Modules/_ssl.c
index 4c0da6f5cb24d3201fc1b2455f724f709d25e4d0..afe699b51654eb922b0ebfe208fb6d56eb5dd029 100644 (file)
--- a/Modules/_ssl.c
+++ b/Modules/_ssl.c
@@ -183,9 +183,9 @@ newPySSLObject(PySocketSockObject *Sock, char *key_file, char *cert_file)
        int sockstate;
 
        self = PyObject_New(PySSLObject, &PySSL_Type); /* Create new object */
-       if (self == NULL){
-               errstr = "newPySSLObject error";
-               goto fail;
+       if (self == NULL) {
+               PyErr_SetString(PySSLErrorObject, "newPySSLObject error");
+               return NULL;
        }
        memset(self->server, '\0', sizeof(char) * X509_NAME_MAXLEN);
        memset(self->issuer, '\0', sizeof(char) * X509_NAME_MAXLEN);

diff --git a/Objects/longobject.c b/Objects/longobject.c
index 5ac570df3f4ae43aab7642cf06c671e53f12d44c..e04699e2700473e240f6c735d97aa01c2cc92454 100644 (file)
--- a/Objects/longobject.c
+++ b/Objects/longobject.c
@@ -66,8 +66,7 @@ long_normalize(register PyLongObject *v)
 PyLongObject *
 _PyLong_New(Py_ssize_t size)
 {
-       if (size > INT_MAX) {
-               /* XXX: Fix this check when ob_size becomes ssize_t */
+       if (size > PY_SSIZE_T_MAX) {
                PyErr_NoMemory();
                return NULL;
        }
@@ -1580,9 +1579,10 @@ x_divrem(PyLongObject *v1, PyLongObject *w1, PyLongObject **prem)
        assert(size_w == ABS(w->ob_size)); /* That's how d was calculated */
 
        size_v = ABS(v->ob_size);
-       a = _PyLong_New(size_v - size_w + 1);
+       k = size_v - size_w;
+       a = _PyLong_New(k + 1);
 
-       for (j = size_v, k = a->ob_size-1; a != NULL && k >= 0; --j, --k) {
+       for (j = size_v; a != NULL && k >= 0; --j, --k) {
                digit vj = (j >= size_v) ? 0 : v->ob_digit[j];
                twodigits q;
                stwodigits carry = 0;