Fix a crash: when sq_item failed the code continued blindly and used the

doerwalter · doerwalter · commit c58a3a10a91f · 2003-08-18T18:28:45.000Z
NULL pointer. (Detected by Michael Hudson, patch provided by Neal Norwitz).

Fix refcounting leak in filtertuple().
diff --git a/Python/bltinmodule.c b/Python/bltinmodule.c
@@ -2174,6 +2174,8 @@ filtertuple(PyObject *func, PyObject *tuple)
 		if (tuple->ob_type->tp_as_sequence &&
 		    tuple->ob_type->tp_as_sequence->sq_item) {
 			item = tuple->ob_type->tp_as_sequence->sq_item(tuple, i);
+			if (item == NULL)
+				goto Fail_1;
 		} else {
 			PyErr_SetString(PyExc_TypeError, "filter(): unsubscriptable tuple");
 			goto Fail_1;
@@ -2184,20 +2186,25 @@ filtertuple(PyObject *func, PyObject *tuple)
 		}
 		else {
 			PyObject *arg = Py_BuildValue("(O)", item);
-			if (arg == NULL)
+			if (arg == NULL) {
+				Py_DECREF(item);
 				goto Fail_1;
+			}
 			good = PyEval_CallObject(func, arg);
 			Py_DECREF(arg);
-			if (good == NULL)
+			if (good == NULL) {
+				Py_DECREF(item);
 				goto Fail_1;
+			}
 		}
 		ok = PyObject_IsTrue(good);
 		Py_DECREF(good);
 		if (ok) {
-			Py_INCREF(item);
 			if (PyTuple_SetItem(result, j++, item) < 0)
 				goto Fail_1;
 		}
+		else
+			Py_DECREF(item);
 	}
 
 	if (_PyTuple_Resize(&result, j) < 0)
