SF bug #1238681: freed pointer is used in longobject.c:long_pow().

tim-one · tim-one · commit de7990b8af50 · 2005-07-17T23:45:23.000Z
In addition, long_pow() skipped a necessary (albeit extremely unlikely
to trigger) error check when converting an int modulus to long.

Alas, I was unable to write a test case that crashed due to either
cause.

Bugfix candidate.
diff --git a/Misc/NEWS b/Misc/NEWS
@@ -12,6 +12,8 @@ What's New in Python 2.5 alpha 1?
 Core and builtins
 -----------------
 
+- SF bug #1238681:  freed pointer is used in longobject.c:long_pow().
+
 - SF bug #1229429: PyObject_CallMethod failed to decrement some
   reference counts in some error exit cases.
 
diff --git a/Objects/longobject.c b/Objects/longobject.c
@@ -2360,8 +2360,11 @@ long_pow(PyObject *v, PyObject *w, PyObject *x)
 		c = (PyLongObject *)x;
 		Py_INCREF(x);
 	}
-	else if (PyInt_Check(x))
+	else if (PyInt_Check(x)) {
 		c = (PyLongObject *)PyLong_FromLong(PyInt_AS_LONG(x));
+		if (c == NULL)
+			goto Error;
+	}
 	else if (x == Py_None)
 		c = NULL;
 	else {
@@ -2511,14 +2514,14 @@ long_pow(PyObject *v, PyObject *w, PyObject *x)
  	}
 	/* fall through */
  Done:
-	Py_XDECREF(a);
-	Py_XDECREF(b);
-	Py_XDECREF(c);
-	Py_XDECREF(temp);
 	if (b->ob_size > FIVEARY_CUTOFF) {
 		for (i = 0; i < 32; ++i)
 			Py_XDECREF(table[i]);
 	}
+	Py_DECREF(a);
+	Py_DECREF(b);
+	Py_XDECREF(c);
+	Py_XDECREF(temp);
 	return (PyObject *)z;
 }
 
