[Python-Dev] Potential NULL pointer dereference in descrobject.c

[Michael Mueller]

Hi Guys,

We've been analyzing CPython with our static analysis tool (Sentry)
and a NULL pointer dereference popped up the other day, in
Objects/descrobject.c:

    if (descr != NULL) {
        Py_XINCREF(type);
        descr->d_type = type;
        descr->d_name = PyUnicode_InternFromString(name);
        if (descr->d_name == NULL) {
            Py_DECREF(descr);
            descr = NULL;
        }
        descr->d_qualname = NULL; // Possible NULL pointer dereference
    }

If the inner conditional block can be reached, descr will be set NULL
and then dereferenced on the next line.  The commented line above was
added in this commit: http://hg.python.org/cpython/rev/73948#l4.92

Hopefully someone can take a look and determine the appropriate fix.

Best,
Mike

-- 
Mike Mueller
Phone: (401) 405-1525
Email: mmueller at vigilantsw.com

http://www.vigilantsw.com/
Static Analysis for C and C++