[Python-checkins] bpo-34784: Implement correct cleanup in PyStructSequence new implementation (GH-10536)

[Pablo Galindo]

https://github.com/python/cpython/commit/bfb855bef6b428d639693caaf4e4c84cbb8a2f51
commit: bfb855bef6b428d639693caaf4e4c84cbb8a2f51
branch: master
author: Pablo Galindo <Pablogsal at gmail.com>
committer: GitHub <noreply at github.com>
date: 2018-11-15T02:03:57Z
summary:

bpo-34784: Implement correct cleanup in PyStructSequence new implementation (GH-10536)

PyTuple_Pack can fail and return NULL. If this happens, then PyType_FromSpecWithBases will incorrectly create a new type without bases. Also, it will crash on the Py_DECREF that follows. Also free members and type in error conditions.

files:
M Objects/structseq.c

diff --git a/Objects/structseq.c b/Objects/structseq.c
index d5137109f8db..05ea87b67a82 100644
--- a/Objects/structseq.c
+++ b/Objects/structseq.c
@@ -447,6 +447,10 @@ PyStructSequence_NewType(PyStructSequence_Desc *desc)
     spec.slots = slots;
 
     bases = PyTuple_Pack(1, &PyTuple_Type);
+    if (bases == NULL) {
+        PyMem_FREE(members);
+        return NULL;
+    }
     type = (PyTypeObject *)PyType_FromSpecWithBases(&spec, bases);
     Py_DECREF(bases);
     PyMem_FREE(members);
@@ -456,6 +460,7 @@ PyStructSequence_NewType(PyStructSequence_Desc *desc)
 
     if (initialize_structseq_dict(
             desc, type->tp_dict, n_members, n_unnamed_members) < 0) {
+        Py_DECREF(type);
         return NULL;
     }