Fix a possible crash due to PyType_FromSpecWithBases() (GH-10304)

If the PyObject_MALLOC() call failed in PyType_FromSpecWithBases(), PyObject_Free() would be called on a static string in type_dealloc().
python · May 9, 2019 · 0613c1e · 0613c1e
1 parent e657624
commit 0613c1e
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/Objects/typeobject.c b/Objects/typeobject.c
@@ -2995,6 +2995,7 @@ PyType_FromSpecWithBases(PyType_Spec *spec, PyObject *bases)
             size_t len = strlen(old_doc)+1;
             char *tp_doc = PyObject_MALLOC(len);
             if (tp_doc == NULL) {
+                type->tp_doc = NULL;
                 PyErr_NoMemory();
                 goto fail;
             }