Thanks to Coverity, these were all reported by their Prevent tool.

nnorwitz · nnorwitz · commit 60da31660c6a · 2006-03-07T04:48:24.000Z
All of these (except _lsprof.c) should be backported.  Particularly
the hotshot change which validates sys.path.  Can someone backport?
diff --git a/Lib/test/test_hotshot.py b/Lib/test/test_hotshot.py
@@ -107,6 +107,19 @@ def test_start_stop(self):
         profiler.close()
         os.unlink(self.logfn)
 
+    def test_bad_sys_path(self):
+        import sys
+        orig_path = sys.path
+        coverage = hotshot._hotshot.coverage
+        try:
+            # verify we require a list for sys.path
+            sys.path = 'abc'
+            self.assertRaises(RuntimeError, coverage, test_support.TESTFN)
+            # verify sys.path exists
+            del sys.path
+            self.assertRaises(RuntimeError, coverage, test_support.TESTFN)
+        finally:
+            sys.path = orig_path
 
 def test_main():
     test_support.run_unittest(HotShotTestCase)
diff --git a/Modules/_hotshot.c b/Modules/_hotshot.c
@@ -473,6 +473,8 @@ logreader_tp_iternext(LogReaderObject *self)
     }
     else if (!err) {
         result = PyTuple_New(4);
+        if (result == NULL)
+            return NULL;
         PyTuple_SET_ITEM(result, 0, PyInt_FromLong(what));
         PyTuple_SET_ITEM(result, 2, PyInt_FromLong(fileno));
         if (s1 == NULL)
@@ -1455,6 +1457,10 @@ write_header(ProfilerObject *self)
                   getcwd(cwdbuffer, sizeof cwdbuffer));
 
     temp = PySys_GetObject("path");
+    if (temp == NULL || !PyList_Check(temp)) {
+	PyErr_SetString(PyExc_RuntimeError, "sys.path must be a list");
+    	return -1;
+    }
     len = PyList_GET_SIZE(temp);
     for (i = 0; i < len; ++i) {
         PyObject *item = PyList_GET_ITEM(temp, i);
diff --git a/Modules/_lsprof.c b/Modules/_lsprof.c
@@ -850,6 +850,8 @@ init_lsprof(void)
 {
 	PyObject *module, *d;
 	module = Py_InitModule3("_lsprof", moduleMethods, "Fast profiler");
+	if (module == NULL)
+		return;
 	d = PyModule_GetDict(module);
 	if (PyType_Ready(&PyProfiler_Type) < 0)
 		return;
diff --git a/Modules/_sre.c b/Modules/_sre.c
@@ -2983,7 +2983,7 @@ match_groupdict(MatchObject* self, PyObject* args, PyObject* kw)
     return result;
 
 failed:
-    Py_DECREF(keys);
+    Py_XDECREF(keys);
     Py_DECREF(result);
     return NULL;
 }
diff --git a/Modules/audioop.c b/Modules/audioop.c
@@ -1013,6 +1013,8 @@ audioop_ratecv(PyObject *self, PyObject *args)
 		while (d < 0) {
 			if (len == 0) {
 				samps = PyTuple_New(nchannels);
+				if (samps == NULL)
+					goto exit;
 				for (chan = 0; chan < nchannels; chan++)
 					PyTuple_SetItem(samps, chan,
 						Py_BuildValue("(ii)",
diff --git a/Modules/regexmodule.c b/Modules/regexmodule.c
@@ -535,7 +535,7 @@ regex_symcomp(PyObject *self, PyObject *args)
 
 	gdict = PyDict_New();
 	if (gdict == NULL || (npattern = symcomp(pattern, gdict)) == NULL) {
-		Py_DECREF(gdict);
+		Py_XDECREF(gdict);
 		Py_DECREF(pattern);
 		return NULL;
 	}

Original file line number	Diff line number	Diff line change
`@@ -850,6 +850,8 @@ init_lsprof(void)`
`850`	`850`	`{`
`851`	`851`	`PyObject module, d;`
`852`	`852`	`module = Py_InitModule3("_lsprof", moduleMethods, "Fast profiler");`
	`853`	`+ if (module == NULL)`
	`854`	`+ return;`
`853`	`855`	`d = PyModule_GetDict(module);`
`854`	`856`	`if (PyType_Ready(&PyProfiler_Type) < 0)`
`855`	`857`	`return;`
Original file line number	Diff line number	Diff line change
`@@ -2983,7 +2983,7 @@ match_groupdict(MatchObject* self, PyObject* args, PyObject* kw)`
`2983`	`2983`	`return result;`
`2984`	`2984`
`2985`	`2985`	`failed:`
`2986`		`- Py_DECREF(keys);`
	`2986`	`+ Py_XDECREF(keys);`
`2987`	`2987`	`Py_DECREF(result);`
`2988`	`2988`	`return NULL;`
`2989`	`2989`	`}`
Original file line number	Diff line number	Diff line change
`@@ -535,7 +535,7 @@ regex_symcomp(PyObject self, PyObject args)`
`535`	`535`
`536`	`536`	`gdict = PyDict_New();`
`537`	`537`	`if (gdict == NULL \|\| (npattern = symcomp(pattern, gdict)) == NULL) {`
`538`		`- Py_DECREF(gdict);`
	`538`	`+ Py_XDECREF(gdict);`
`539`	`539`	`Py_DECREF(pattern);`
`540`	`540`	`return NULL;`
`541`	`541`	`}`