From 52d61e485eeebcd3cc9ebdf0c762d100fc2916dc Mon Sep 17 00:00:00 2001
From: Victor Stinner <victor.stinner@gmail.com>
Date: Mon, 12 Sep 2016 11:41:58 +0200
Subject: [PATCH] socket: Fix memory leak in sendmsg() and sendmsg_afalg()

Issue #27744:

* Release msg.msg_iov memory block.
* Release memory on PyMem_Malloc(controllen) failure
---
 Modules/socketmodule.c | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/Modules/socketmodule.c b/Modules/socketmodule.c
index 0490d71b418..eee607fd139 100644
--- a/Modules/socketmodule.c
+++ b/Modules/socketmodule.c
@@ -4072,11 +4072,13 @@ sock_sendmsg(PySocketSockObject *s, PyObject *args)
     if (ncmsgbufs > 0) {
         struct cmsghdr *cmsgh = NULL;
 
-        if ((msg.msg_control = controlbuf =
-             PyMem_Malloc(controllen)) == NULL) {
+        controlbuf = PyMem_Malloc(controllen);
+        if (controlbuf == NULL) {
             PyErr_NoMemory();
             goto finally;
         }
+        msg.msg_control = controlbuf;
+
         msg.msg_controllen = controllen;
 
         /* Need to zero out the buffer as a workaround for glibc's
@@ -4141,8 +4143,10 @@ finally:
         PyBuffer_Release(&cmsgs[i].data);
     PyMem_Free(cmsgs);
     Py_XDECREF(cmsg_fast);
-    for (i = 0; i < ndatabufs; i++)
+    PyMem_Free(msg.msg_iov);
+    for (i = 0; i < ndatabufs; i++) {
         PyBuffer_Release(&databufs[i]);
+    }
     PyMem_Free(databufs);
     return retval;
 }
@@ -4243,7 +4247,8 @@ sock_sendmsg_afalg(PySocketSockObject *self, PyObject *args, PyObject *kwds)
 
     controlbuf = PyMem_Malloc(controllen);
     if (controlbuf == NULL) {
-        return PyErr_NoMemory();
+        PyErr_NoMemory();
+        goto finally;
     }
     memset(controlbuf, 0, controllen);
 
@@ -4315,8 +4320,10 @@ sock_sendmsg_afalg(PySocketSockObject *self, PyObject *args, PyObject *kwds)
     if (iv.buf != NULL) {
         PyBuffer_Release(&iv);
     }
-    for (i = 0; i < ndatabufs; i++)
+    PyMem_Free(msg.msg_iov);
+    for (i = 0; i < ndatabufs; i++) {
         PyBuffer_Release(&databufs[i]);
+    }
     PyMem_Free(databufs);
     return retval;
 }