diff --git a/Misc/NEWS b/Misc/NEWS index 769b80e7307..ff6fe06db7b 100644 --- a/Misc/NEWS +++ b/Misc/NEWS @@ -12,6 +12,9 @@ What's New in Python 3.3.3 release candidate 1? Core and Builtins ----------------- +- Issue #18552: Check return value of PyArena_AddPyObject() in + obj2ast_object(). + - Issue #18560: Fix potential NULL pointer dereference in sum(). - Issue #15905: Fix theoretical buffer overflow in handling of sys.argv[0], diff --git a/Parser/asdl_c.py b/Parser/asdl_c.py index 25682229cc5..e61aae24d12 100755 --- a/Parser/asdl_c.py +++ b/Parser/asdl_c.py @@ -834,9 +834,13 @@ static int obj2ast_object(PyObject* obj, PyObject** out, PyArena* arena) { if (obj == Py_None) obj = NULL; - if (obj) - PyArena_AddPyObject(arena, obj); - Py_XINCREF(obj); + if (obj) { + if (PyArena_AddPyObject(arena, obj) < 0) { + *out = NULL; + return -1; + } + Py_INCREF(obj); + } *out = obj; return 0; } diff --git a/Python/Python-ast.c b/Python/Python-ast.c index d78657ce075..7bf2c5092d3 100644 --- a/Python/Python-ast.c +++ b/Python/Python-ast.c @@ -688,9 +688,13 @@ static int obj2ast_object(PyObject* obj, PyObject** out, PyArena* arena) { if (obj == Py_None) obj = NULL; - if (obj) - PyArena_AddPyObject(arena, obj); - Py_XINCREF(obj); + if (obj) { + if (PyArena_AddPyObject(arena, obj) < 0) { + *out = NULL; + return -1; + } + Py_INCREF(obj); + } *out = obj; return 0; }