From: Kristján Valur Jónsson <kristjan@ccpgames.com>
Date: Mon, 28 Sep 2009 13:08:48 +0000 (+0000)
Subject: http://bugs.python.org/issue6836
X-Git-Tag: v2.7a1~452
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=d12f86ce96d3aeb91e9c7f010e303bbc1b8d14da;p=python

http://bugs.python.org/issue6836
A memory block allocated with one API was being handed over to an object that used another API to release it.
---

diff --git a/Parser/parsetok.c b/Parser/parsetok.c
index 71792dd469..3994add5eb 100644
--- a/Parser/parsetok.c
+++ b/Parser/parsetok.c
@@ -243,16 +243,24 @@ parsetok(struct tok_state *tok, grammar *g, int start, perrdetail *err_ret,
 			err_ret->text = text;
 		}
 	} else if (tok->encoding != NULL) {
+		/* 'nodes->n_str' uses PyObject_*, while 'tok->encoding' was
+		 * allocated using PyMem_
+		 */
 		node* r = PyNode_New(encoding_decl);
-		if (!r) {
+		if (r)
+			r->n_str = PyObject_MALLOC(strlen(tok->encoding)+1);
+		if (!r || !r->n_str) {
 			err_ret->error = E_NOMEM;
+			if (r)
+				PyObject_FREE(r);
 			n = NULL;
 			goto done;
 		}
-		r->n_str = tok->encoding;
+		strcpy(r->n_str, tok->encoding);
+		PyMem_FREE(tok->encoding);
+		tok->encoding = NULL;
 		r->n_nchildren = 1;
 		r->n_child = n;
-		tok->encoding = NULL;
 		n = r;
 	}