[Python-checkins] cpython (merge 3.5 -> default): merge 3.5 (#27783)

[benjamin.peterson]

https://hg.python.org/cpython/rev/0f0a040d45b2
changeset:   102716:0f0a040d45b2
parent:      102711:e615718a6455
parent:      102715:d1b93ce7dad8
user:        Benjamin Peterson <benjamin at python.org>
date:        Tue Aug 16 23:37:42 2016 -0700
summary:
  merge 3.5 (#27783)

files:
  Misc/NEWS           |   2 ++
  Modules/_operator.c |  16 ++++++++--------
  2 files changed, 10 insertions(+), 8 deletions(-)


diff --git a/Misc/NEWS b/Misc/NEWS
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -110,6 +110,8 @@
 - In the curses module, raise an error if window.getstr() or window.instr() is
   passed a negative value.
 
+- Issue #27783: Fix possible usage of uninitialized memory in operator.methodcaller.
+
 - Issue #27774: Fix possible Py_DECREF on unowned object in _sre.
 
 - Issue #27760: Fix possible integer overflow in binascii.b2a_qp.
diff --git a/Modules/_operator.c b/Modules/_operator.c
--- a/Modules/_operator.c
+++ b/Modules/_operator.c
@@ -931,7 +931,7 @@
 methodcaller_new(PyTypeObject *type, PyObject *args, PyObject *kwds)
 {
     methodcallerobject *mc;
-    PyObject *name, *newargs;
+    PyObject *name;
 
     if (PyTuple_GET_SIZE(args) < 1) {
         PyErr_SetString(PyExc_TypeError, "methodcaller needs at least "
@@ -951,13 +951,7 @@
     if (mc == NULL)
         return NULL;
 
-    newargs = PyTuple_GetSlice(args, 1, PyTuple_GET_SIZE(args));
-    if (newargs == NULL) {
-        Py_DECREF(mc);
-        return NULL;
-    }
-    mc->args = newargs;
-
+    name = PyTuple_GET_ITEM(args, 0);
     Py_INCREF(name);
     PyUnicode_InternInPlace(&name);
     mc->name = name;
@@ -965,6 +959,12 @@
     Py_XINCREF(kwds);
     mc->kwds = kwds;
 
+    mc->args = PyTuple_GetSlice(args, 1, PyTuple_GET_SIZE(args));
+    if (mc->args == NULL) {
+        Py_DECREF(mc);
+        return NULL;
+    }
+
     PyObject_GC_Track(mc);
     return (PyObject *)mc;
 }

-- 
Repository URL: https://hg.python.org/cpython