From 0613c1e481440aa8f54ba7f6056924c175fbcc13 Mon Sep 17 00:00:00 2001 From: Zackery Spytz Date: Thu, 9 May 2019 12:33:32 -0600 Subject: [PATCH] Fix a possible crash due to PyType_FromSpecWithBases() (GH-10304) If the PyObject_MALLOC() call failed in PyType_FromSpecWithBases(), PyObject_Free() would be called on a static string in type_dealloc(). --- Objects/typeobject.c | 1 + 1 file changed, 1 insertion(+) diff --git a/Objects/typeobject.c b/Objects/typeobject.c index eeaae1f9f7..b28f494962 100644 --- a/Objects/typeobject.c +++ b/Objects/typeobject.c @@ -2995,6 +2995,7 @@ PyType_FromSpecWithBases(PyType_Spec *spec, PyObject *bases) size_t len = strlen(old_doc)+1; char *tp_doc = PyObject_MALLOC(len); if (tp_doc == NULL) { + type->tp_doc = NULL; PyErr_NoMemory(); goto fail; } -- 2.40.0