traverseda
/
cpython
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

closes bpo-34501: PyType_FromSpecWithBases: Check spec->name before dereferencing it. (GH-8930) 

Reported by Svace static analyzer.
This commit is contained in:
Alexey Izbyshev 2018-08-25 21:53:47 +03:00 committed by Benjamin Peterson
parent 44838be9f7
commit 5f79b50763
1 changed files with 9 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
Objects/typeobject.c
View File

@ -2847,6 +2847,15 @@ PyType_FromSpecWithBases(PyType_Spec *spec, PyObject *bases)
char *res_start = (char*)res; char *res_start = (char*)res;
PyType_Slot *slot; PyType_Slot *slot;
if (res == NULL)
return NULL;
if (spec->name == NULL) {
PyErr_SetString(PyExc_SystemError,
"Type spec does not define the name field.");
goto fail;
}
/* Set the type name and qualname */ /* Set the type name and qualname */
s = strrchr(spec->name, '.'); s = strrchr(spec->name, '.');
if (s == NULL) if (s == NULL)
@ -2854,8 +2863,6 @@ PyType_FromSpecWithBases(PyType_Spec *spec, PyObject *bases)
else else
s++; s++;
if (res == NULL)
return NULL;
type = &res->ht_type; type = &res->ht_type;
/* The flags must be initialized early, before the GC traverses us */ /* The flags must be initialized early, before the GC traverses us */
type->tp_flags = spec->flags | Py_TPFLAGS_HEAPTYPE; type->tp_flags = spec->flags | Py_TPFLAGS_HEAPTYPE;
@ -2865,8 +2872,6 @@ PyType_FromSpecWithBases(PyType_Spec *spec, PyObject *bases)
res->ht_qualname = res->ht_name; res->ht_qualname = res->ht_name;
Py_INCREF(res->ht_qualname); Py_INCREF(res->ht_qualname);
type->tp_name = spec->name; type->tp_name = spec->name;
if (!type->tp_name)
goto fail;
/* Adjust for empty tuple bases */ /* Adjust for empty tuple bases */
if (!bases) { if (!bases) {