[Python-checkins] r88443 - in python/branches/py3k: Misc/NEWS Objects/typeobject.c

[georg.brandl]

Author: georg.brandl
Date: Sat Feb 19 22:47:02 2011
New Revision: 88443

Log:
#11249: in PyType_FromSpec, copy tp_doc slot since it usually will point to a static string literal which should not be deallocated together with the type.

Modified:
   python/branches/py3k/Misc/NEWS
   python/branches/py3k/Objects/typeobject.c

Modified: python/branches/py3k/Misc/NEWS
==============================================================================
--- python/branches/py3k/Misc/NEWS	(original)
+++ python/branches/py3k/Misc/NEWS	Sat Feb 19 22:47:02 2011
@@ -10,6 +10,8 @@
 Core and Builtins
 -----------------
 
+- Issue #11249: Fix potential crashes when using the limited API.
+
 Library
 -------
 

Modified: python/branches/py3k/Objects/typeobject.c
==============================================================================
--- python/branches/py3k/Objects/typeobject.c	(original)
+++ python/branches/py3k/Objects/typeobject.c	Sat Feb 19 22:47:02 2011
@@ -2347,6 +2347,17 @@
 	    goto fail;
 	}
 	*(void**)(res_start + slotoffsets[slot->slot]) = slot->pfunc;
+
+        /* need to make a copy of the docstring slot, which usually
+           points to a static string literal */
+        if (slot->slot == Py_tp_doc) {
+            ssize_t len = strlen(slot->pfunc)+1;
+            char *tp_doc = PyObject_MALLOC(len);
+            if (tp_doc == NULL)
+	    	goto fail;
+            memcpy(tp_doc, slot->pfunc, len);
+            res->ht_type.tp_doc = tp_doc;
+        }
     }
 
     return (PyObject*)res;