Skip to content

Commit 6aa4257

Browse files
committed
PyPcre_expand(): Fixed two memory leaks, where a PyString_FromString()
was appended to a list. Lists are reference count neutral, so the string must be DECREF'd. Also added some checks for the return value of PyList_Append(). Note: there are still some memory problems reported by Purify (I get two Array Bounds Reads still and an Unitialized Memory Read). Also, in scanning the code, there appears to be some potential problems where return values aren't checked. To much to attack now though.
1 parent a61f4ac commit 6aa4257

1 file changed

Lines changed: 26 additions & 3 deletions

File tree

Modules/pcremodule.c

Lines changed: 26 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -489,8 +489,19 @@ PyPcre_expand(self, args)
489489

490490
if (start!=i)
491491
{
492-
PyList_Append(results,
493-
PyString_FromStringAndSize((char *)repl+start, i-start));
492+
int status;
493+
PyObject *s = PyString_FromStringAndSize(
494+
(char *)repl+start, i-start);
495+
if (s == NULL) {
496+
Py_DECREF(results);
497+
return NULL;
498+
}
499+
status = PyList_Append(results, s);
500+
Py_DECREF(s);
501+
if (status < 0) {
502+
Py_DECREF(results);
503+
return NULL;
504+
}
494505
total_len += i-start;
495506
}
496507
i++;
@@ -574,7 +585,19 @@ PyPcre_expand(self, args)
574585

575586
if (start!=i)
576587
{
577-
PyList_Append(results, PyString_FromStringAndSize((char *)repl+start, i-start));
588+
int status;
589+
PyObject *s = PyString_FromStringAndSize((char *)repl+start,
590+
i-start);
591+
if (s == NULL) {
592+
Py_DECREF(results);
593+
return NULL;
594+
}
595+
status = PyList_Append(results, s);
596+
Py_DECREF(s);
597+
if (status < 0) {
598+
Py_DECREF(results);
599+
return NULL;
600+
}
578601
total_len += i-start;
579602
}
580603

0 commit comments

Comments
 (0)