Avoid a potential double-free bug.

diff --git a/Modules/_ctypes/_ctypes.c b/Modules/_ctypes/_ctypes.c
index ac4859ee05515c246610ef90793f6a5b8587302d..daaec022fe43faaf24885b539a0a1f19d1d30bb8 100644 (file)
--- a/Modules/_ctypes/_ctypes.c
+++ b/Modules/_ctypes/_ctypes.c
@@ -3191,8 +3191,10 @@ CFuncPtr_clear(CFuncPtrObject *self)
        Py_CLEAR(self->converters);
        Py_CLEAR(self->paramflags);
 
-       if (self->thunk)
+       if (self->thunk) {
                FreeCallback(self->thunk);
+               PyMem_Free(self->thunk);
+       }
        self->thunk = NULL;
 
        return CData_clear((CDataObject *)self);

diff --git a/Modules/_ctypes/callbacks.c b/Modules/_ctypes/callbacks.c
index 286faa351876895d26afbbd8362d54f12835e635..4b1ca58483eacd23bc5d60f64c019bde2ce9868d 100644 (file)
--- a/Modules/_ctypes/callbacks.c
+++ b/Modules/_ctypes/callbacks.c
@@ -292,7 +292,6 @@ static void closure_fcn(ffi_cif *cif,
 void FreeCallback(THUNK thunk)
 {
        FreeClosure(((ffi_info *)thunk)->pcl);
-       PyMem_Free(thunk);
 }
 
 THUNK AllocFunctionCallback(PyObject *callable,