SF bug #1238681: freed pointer is used in longobject.c:long_pow().

In addition, long_pow() skipped a necessary (albeit extremely unlikely
to trigger) error check when converting an int modulus to long.

Alas, I was unable to write a test case that crashed due to either
cause.

Bugfix candidate.

diff --git a/Misc/NEWS b/Misc/NEWS
index 89583e094c58f1e137b5d02773fd9bef5fd792ff..27d27632fe83e94bfeed288d2e1652756b8aefac 100644 (file)
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -12,6 +12,8 @@ What's New in Python 2.5 alpha 1?
 Core and builtins
 -----------------
 
+- SF bug #1238681:  freed pointer is used in longobject.c:long_pow().
+
 - SF bug #1229429: PyObject_CallMethod failed to decrement some
   reference counts in some error exit cases.
 

diff --git a/Objects/longobject.c b/Objects/longobject.c
index 1f328dd35d07139516734ccb271f8bbf41d4c00b..ff5ba6f2eba009f57f9541951d9b219375462aa9 100644 (file)
--- a/Objects/longobject.c
+++ b/Objects/longobject.c
@@ -2360,8 +2360,11 @@ long_pow(PyObject *v, PyObject *w, PyObject *x)
                c = (PyLongObject *)x;
                Py_INCREF(x);
        }
-       else if (PyInt_Check(x))
+       else if (PyInt_Check(x)) {
                c = (PyLongObject *)PyLong_FromLong(PyInt_AS_LONG(x));
+               if (c == NULL)
+                       goto Error;
+       }
        else if (x == Py_None)
                c = NULL;
        else {
@@ -2511,14 +2514,14 @@ long_pow(PyObject *v, PyObject *w, PyObject *x)
        }
        /* fall through */
  Done:
-       Py_XDECREF(a);
-       Py_XDECREF(b);
-       Py_XDECREF(c);
-       Py_XDECREF(temp);
        if (b->ob_size > FIVEARY_CUTOFF) {
                for (i = 0; i < 32; ++i)
                        Py_XDECREF(table[i]);
        }
+       Py_DECREF(a);
+       Py_DECREF(b);
+       Py_XDECREF(c);
+       Py_XDECREF(temp);
        return (PyObject *)z;
 }