SF patch 703666: Several objects don't decref tmp on failure in subtype_new

Submitted By: Christopher A. Craig

Fillin some missing decrefs.

diff --git a/Objects/floatobject.c b/Objects/floatobject.c
index f36479f9789351eb1bda1262e535f7002acc69f2..9ed53e2574fba772d90ce73517240c2b86620e45 100644 (file)
--- a/Objects/floatobject.c
+++ b/Objects/floatobject.c
@@ -751,8 +751,10 @@ float_subtype_new(PyTypeObject *type, PyObject *args, PyObject *kwds)
                return NULL;
        assert(PyFloat_CheckExact(tmp));
        new = type->tp_alloc(type, 0);
-       if (new == NULL)
+       if (new == NULL) {
+               Py_DECREF(tmp);
                return NULL;
+       }
        ((PyFloatObject *)new)->ob_fval = ((PyFloatObject *)tmp)->ob_fval;
        Py_DECREF(tmp);
        return new;

diff --git a/Objects/intobject.c b/Objects/intobject.c
index 4b5dc55632bf398c2900518021fc7216fedad686..a3df3bab61f5a288b44e59c996d6bcdac801e464 100644 (file)
--- a/Objects/intobject.c
+++ b/Objects/intobject.c
@@ -958,8 +958,10 @@ int_subtype_new(PyTypeObject *type, PyObject *args, PyObject *kwds)
        }
 
        new = type->tp_alloc(type, 0);
-       if (new == NULL)
+       if (new == NULL) {
+               Py_DECREF(tmp);
                return NULL;
+       }
        ((PyIntObject *)new)->ob_ival = ival;
        Py_DECREF(tmp);
        return new;

diff --git a/Objects/longobject.c b/Objects/longobject.c
index 52c30c2be857821697fb4908bd20e204e117a151..f246bd2320f2183648e899f637aaab3150940ca0 100644 (file)
--- a/Objects/longobject.c
+++ b/Objects/longobject.c
@@ -2794,8 +2794,10 @@ long_subtype_new(PyTypeObject *type, PyObject *args, PyObject *kwds)
        if (n < 0)
                n = -n;
        new = (PyLongObject *)type->tp_alloc(type, n);
-       if (new == NULL)
+       if (new == NULL) {
+               Py_DECREF(tmp);
                return NULL;
+       }
        assert(PyLong_Check(new));
        new->ob_size = tmp->ob_size;
        for (i = 0; i < n; i++)

diff --git a/Objects/unicodeobject.c b/Objects/unicodeobject.c
index 94c67c84df3b7d5f77a2e73aa374623053bb7d3a..af427dd11887c2ae8546b24f588e6a4fcccb729a 100644 (file)
--- a/Objects/unicodeobject.c
+++ b/Objects/unicodeobject.c
@@ -6688,12 +6688,15 @@ unicode_subtype_new(PyTypeObject *type, PyObject *args, PyObject *kwds)
                return NULL;
        assert(PyUnicode_Check(tmp));
        pnew = (PyUnicodeObject *) type->tp_alloc(type, n = tmp->length);
-       if (pnew == NULL)
+       if (pnew == NULL) {
+               Py_DECREF(tmp);
                return NULL;
+       }
        pnew->str = PyMem_NEW(Py_UNICODE, n+1);
        if (pnew->str == NULL) {
                _Py_ForgetReference((PyObject *)pnew);
                PyObject_Del(pnew);
+               Py_DECREF(tmp);
                return PyErr_NoMemory();
        }
        Py_UNICODE_COPY(pnew->str, tmp->str, n+1);