manifest: fix leak on error return from lazymanifest_filtercopy() stable
authorYuya Nishihara <yuya@tcha.org>
Wed, 05 Sep 2018 21:49:44 +0900
branchstable
changeset 38787 094d1f42c484
parent 38786 ca77788c81bc
child 38788 c68cfc55af9d
child 39471 481db51c83e9
manifest: fix leak on error return from lazymanifest_filtercopy() Spotted by ASAN. free(copy->lines) and Py_DECREF(copy->pydata) are replaced by Py_XDECREF(copy), which should call lazymanifest_dealloc(). Freeing half-initialized copy->lines is safe since copy->numlines holds a valid value.
mercurial/cext/manifest.c
--- a/mercurial/cext/manifest.c	Wed Sep 05 21:46:53 2018 +0900
+++ b/mercurial/cext/manifest.c	Wed Sep 05 21:49:44 2018 +0900
@@ -731,16 +731,14 @@
 		arglist = Py_BuildValue(PY23("(s)", "(y)"),
 					self->lines[i].start);
 		if (!arglist) {
-			return NULL;
+			goto bail;
 		}
 		result = PyObject_CallObject(matchfn, arglist);
 		Py_DECREF(arglist);
 		/* if the callback raised an exception, just let it
 		 * through and give up */
 		if (!result) {
-			free(copy->lines);
-			Py_DECREF(copy->pydata);
-			return NULL;
+			goto bail;
 		}
 		if (PyObject_IsTrue(result)) {
 			assert(!(self->lines[i].from_malloc));
@@ -752,6 +750,7 @@
 	return copy;
 nomem:
 	PyErr_NoMemory();
+bail:
 	Py_XDECREF(copy);
 	return NULL;
 }