Skip to content
Snippets Groups Projects
Commit ae7f2786 authored by Yuya Nishihara's avatar Yuya Nishihara
Browse files

manifest: fix possible SEGV caused by uninitialized lazymanifest fields

Before, uninitialized self->pydata would be passed to lazymanifest_dealloc()
on OOM, and Py_DECREF(self->pydata) would crash if we were unlucky.

It's still wrong to do malloc() thingy in tp_init because __init__() may be
called more than once [1], but I don't want to go a step further in stable
branch.

 [1]: https://docs.python.org/2/c-api/typeobj.html#c.PyTypeObject.tp_new
 "The tp_new function should ... do only as much further initialization as
  is absolutely necessary. Initialization that can safely be ignored or
  repeated should be placed in the tp_init handler."
parent 2baf7993
No related branches found
No related tags found
No related merge requests found
......@@ -135,9 +135,17 @@
return 0;
}
static void lazymanifest_init_early(lazymanifest *self)
{
self->pydata = NULL;
self->lines = NULL;
self->numlines = 0;
self->maxlines = 0;
}
static int lazymanifest_init(lazymanifest *self, PyObject *args)
{
char *data;
Py_ssize_t len;
int err, ret;
PyObject *pydata;
......@@ -138,9 +146,11 @@
static int lazymanifest_init(lazymanifest *self, PyObject *args)
{
char *data;
Py_ssize_t len;
int err, ret;
PyObject *pydata;
lazymanifest_init_early(self);
if (!PyArg_ParseTuple(args, "S", &pydata)) {
return -1;
}
......@@ -668,6 +678,7 @@
if (!copy) {
goto nomem;
}
lazymanifest_init_early(copy);
copy->numlines = self->numlines;
copy->livelines = self->livelines;
copy->dirty = false;
......@@ -705,6 +716,7 @@
if (!copy) {
goto nomem;
}
lazymanifest_init_early(copy);
copy->dirty = true;
copy->lines = malloc(self->maxlines * sizeof(line));
if (!copy->lines) {
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment