Fix refcount leak in PyUnicode_EncodeCharmap(). The bug surfaces

when an encoding error occurs and the callback name is unknown,
i.e. when the callback has to be called. The problem was that
the fact that the callback has already been looked up was only
recorded in a local variable in charmap_encoding_error(), because
charmap_encoding_error() got it's own copy of the errorHandler
pointer instead of a pointer to the pointer in
PyUnicode_EncodeCharmap().

diff --git a/Objects/unicodeobject.c b/Objects/unicodeobject.c
index b165597273550b4e3e4a89c9a7428a4cce57bc3d..6044a561112b690f58a4c764c8c5dba71f83959e 100644 (file)
--- a/Objects/unicodeobject.c
+++ b/Objects/unicodeobject.c
@@ -2876,7 +2876,7 @@ static
 int charmap_encoding_error(
     const Py_UNICODE *p, int size, int *inpos, PyObject *mapping,
     PyObject **exceptionObject,
-    int *known_errorHandler, PyObject *errorHandler, const char *errors,
+    int *known_errorHandler, PyObject **errorHandler, const char *errors,
     PyObject **res, int *respos)
 {
     PyObject *repunicode = NULL; /* initialize to prevent gcc warning */
@@ -2959,7 +2959,7 @@ int charmap_encoding_error(
            *inpos = collendpos;
            break;
        default:
-           repunicode = unicode_encode_call_errorhandler(errors, &errorHandler,
+           repunicode = unicode_encode_call_errorhandler(errors, errorHandler,
                encoding, reason, p, size, exceptionObject,
                collstartpos, collendpos, &newpos);
            if (repunicode == NULL)
@@ -3024,7 +3024,7 @@ PyObject *PyUnicode_EncodeCharmap(const Py_UNICODE *p,
        if (x==Py_None) { /* unencodable character */
            if (charmap_encoding_error(p, size, &inpos, mapping,
                &exc,
-               &known_errorHandler, errorHandler, errors,
+               &known_errorHandler, &errorHandler, errors,
                &res, &respos))
                goto onError;
        }