Commitcb1ee3c

Alexey Izbyshev

authored and

committed

closes bpo-34501: PyType_FromSpecWithBases: Check spec->name before dereferencing it. (pythonGH-8930)

Reported by Svace static analyzer.(cherry picked from commit5f79b50)Co-authored-by: Alexey Izbyshev <izbyshev@ispras.ru>

1 parent42a1ca6 commitcb1ee3cCopy full SHA for cb1ee3c

File tree

-4

lines changed

-4

lines changed

Lines changed: 9 additions & 4 deletions

Original file line number	Diff line number	Diff line change
`@@ -2847,15 +2847,22 @@ PyType_FromSpecWithBases(PyType_Spec spec, PyObject bases)`
`2847`	`2847`	`charres_start= (char)res;`
`2848`	`2848`	`PyType_Slot*slot;`
`2849`	`2849`
	`2850`	`+if (res==NULL)`
	`2851`	`+returnNULL;`
	`2852`	`+`
	`2853`	`+if (spec->name==NULL) {`
	`2854`	`+PyErr_SetString(PyExc_SystemError,`
	`2855`	`+"Type spec does not define the name field.");`
	`2856`	`+ gotofail;`
	`2857`	`+ }`
	`2858`	`+`
`2850`	`2859`	`/* Set the type name and qualname */`
`2851`	`2860`	`s=strrchr(spec->name,'.');`
`2852`	`2861`	`if (s==NULL)`
`2853`	`2862`	`s= (char*)spec->name;`
`2854`	`2863`	`else`
`2855`	`2864`	`s++;`
`2856`	`2865`
`2857`		`-if (res==NULL)`
`2858`		`-returnNULL;`
`2859`	`2866`	`type=&res->ht_type;`
`2860`	`2867`	`/* The flags must be initialized early, before the GC traverses us */`
`2861`	`2868`	`type->tp_flags=spec->flags \|Py_TPFLAGS_HEAPTYPE;`
`@@ -2865,8 +2872,6 @@ PyType_FromSpecWithBases(PyType_Spec spec, PyObject bases)`
`2865`	`2872`	`res->ht_qualname=res->ht_name;`
`2866`	`2873`	`Py_INCREF(res->ht_qualname);`
`2867`	`2874`	`type->tp_name=spec->name;`
`2868`		`-if (!type->tp_name)`
`2869`		`- gotofail;`
`2870`	`2875`
`2871`	`2876`	`/* Adjust for empty tuple bases */`
`2872`	`2877`	`if (!bases) {`

Comments

(0)