fix possible refleak in MAKE_FUNCTION (closes #26991)

benjaminp · benjaminp · commit ad887cf7d125 · 2016-05-16T22:52:40.000-07:00
Patch by Xiang Zhang.
diff --git a/Misc/NEWS b/Misc/NEWS
@@ -10,6 +10,8 @@ Release date: tba
 Core and Builtins
 -----------------
 
+- Issue #26991: Fix possible refleak when creating a function with annotations.
+
 - Issue #27039: Fixed bytearray.remove() for values greater than 127.  Patch by
   Joe Jevnik.
 
diff --git a/Python/ceval.c b/Python/ceval.c
@@ -3284,6 +3284,7 @@ PyEval_EvalFrameEx(PyFrameObject *f, int throwflag)
                 PyObject *anns = PyDict_New();
                 if (anns == NULL) {
                     Py_DECREF(func);
+                    Py_DECREF(names);
                     goto error;
                 }
                 name_ix = PyTuple_Size(names);
@@ -3299,9 +3300,11 @@ PyEval_EvalFrameEx(PyFrameObject *f, int throwflag)
                     if (err != 0) {
                         Py_DECREF(anns);
                         Py_DECREF(func);
+                        Py_DECREF(names);
                         goto error;
                     }
                 }
+                Py_DECREF(names);
 
                 if (PyFunction_SetAnnotations(func, anns) != 0) {
                     /* Can't happen unless
@@ -3311,7 +3314,6 @@ PyEval_EvalFrameEx(PyFrameObject *f, int throwflag)
                     goto error;
                 }
                 Py_DECREF(anns);
-                Py_DECREF(names);
             }
 
             /* XXX Maybe this should be a separate opcode? */

Original file line number	Diff line number	Diff line change
`@@ -3284,6 +3284,7 @@ PyEval_EvalFrameEx(PyFrameObject *f, int throwflag)`
`3284`	`3284`	`PyObject *anns = PyDict_New();`
`3285`	`3285`	`if (anns == NULL) {`
`3286`	`3286`	`Py_DECREF(func);`
	`3287`	`+ Py_DECREF(names);`
`3287`	`3288`	`goto error;`
`3288`	`3289`	`}`
`3289`	`3290`	`name_ix = PyTuple_Size(names);`
`@@ -3299,9 +3300,11 @@ PyEval_EvalFrameEx(PyFrameObject *f, int throwflag)`
`3299`	`3300`	`if (err != 0) {`
`3300`	`3301`	`Py_DECREF(anns);`
`3301`	`3302`	`Py_DECREF(func);`
	`3303`	`+ Py_DECREF(names);`
`3302`	`3304`	`goto error;`
`3303`	`3305`	`}`
`3304`	`3306`	`}`
	`3307`	`+ Py_DECREF(names);`
`3305`	`3308`
`3306`	`3309`	`if (PyFunction_SetAnnotations(func, anns) != 0) {`
`3307`	`3310`	`/* Can't happen unless`
`@@ -3311,7 +3314,6 @@ PyEval_EvalFrameEx(PyFrameObject *f, int throwflag)`
`3311`	`3314`	`goto error;`
`3312`	`3315`	`}`
`3313`	`3316`	`Py_DECREF(anns);`
`3314`		`- Py_DECREF(names);`
`3315`	`3317`	`}`
`3316`	`3318`
`3317`	`3319`	`/* XXX Maybe this should be a separate opcode? */`