[Python-Dev] Potential NULL pointer dereference in descrobject.c

[Matt Joiner]

ಠ_ಠ

On Sat, Dec 17, 2011 at 8:55 PM, Michael Mueller
<mmueller at vigilantsw.com> wrote:
> Hi Guys,
>
> We've been analyzing CPython with our static analysis tool (Sentry)
> and a NULL pointer dereference popped up the other day, in
> Objects/descrobject.c:
>
>    if (descr != NULL) {
>        Py_XINCREF(type);
>        descr->d_type = type;
>        descr->d_name = PyUnicode_InternFromString(name);
>        if (descr->d_name == NULL) {
>            Py_DECREF(descr);
>            descr = NULL;
>        }
>        descr->d_qualname = NULL; // Possible NULL pointer dereference
>    }
>
> If the inner conditional block can be reached, descr will be set NULL
> and then dereferenced on the next line.  The commented line above was
> added in this commit: http://hg.python.org/cpython/rev/73948#l4.92
>
> Hopefully someone can take a look and determine the appropriate fix.
>
> Best,
> Mike
>
> --
> Mike Mueller
> Phone: (401) 405-1525
> Email: mmueller at vigilantsw.com
>
> http://www.vigilantsw.com/
> Static Analysis for C and C++
> _______________________________________________
> Python-Dev mailing list
> Python-Dev at python.org
> http://mail.python.org/mailman/listinfo/python-dev
> Unsubscribe: http://mail.python.org/mailman/options/python-dev/anacrolix%40gmail.com



-- 
ಠ_ಠ