BUG: Fix small memory access errors in ujson objToJSON.c (#33929) · pandas-dev/pandas@862db64 (original) (raw)

Original file line number Diff line number Diff line change
@@ -1458,9 +1458,9 @@ char **NpyArr_encodeLabels(PyArrayObject *labels, PyObjectEncoder *enc,
1458 1458
1459 1459 if (is_datetimelike) {
1460 1460 if (nanosecVal == get_nat()) {
1461 -len = 5; // TODO: shouldn't require extra space for terminator
1462 -cLabel = PyObject_Malloc(len);
1463 -strncpy(cLabel, "null", len);
1461 +len = 4;
1462 +cLabel = PyObject_Malloc(len + 1);
1463 +strncpy(cLabel, "null", len + 1);
1464 1464 } else {
1465 1465 if (enc->datetimeIso) {
1466 1466 if ((type_num == NPY_TIMEDELTA) |
@@ -1486,23 +1486,22 @@ char **NpyArr_encodeLabels(PyArrayObject *labels, PyObjectEncoder *enc,
1486 1486 }
1487 1487 }
1488 1488 } else { // Fallback to string representation
1489 -PyObject *str = PyObject_Str(item);
1490 -if (str == NULL) {
1491 - Py_DECREF(item);
1489 +// Replace item with the string to keep it alive.
1490 +Py_SETREF(item, PyObject_Str(item));
1491 +if (item == NULL) {
1492 1492 NpyArr_freeLabels(ret, num);
1493 1493 ret = 0;
1494 1494 break;
1495 1495 }
1496 1496
1497 -cLabel = (char *)PyUnicode_AsUTF8(str);
1498 -Py_DECREF(str);
1497 +cLabel = (char *)PyUnicode_AsUTF8(item);
1499 1498 len = strlen(cLabel);
1500 1499 }
1501 1500
1502 -Py_DECREF(item);
1503 1501 // Add 1 to include NULL terminator
1504 1502 ret[i] = PyObject_Malloc(len + 1);
1505 1503 memcpy(ret[i], cLabel, len + 1);
1504 +Py_DECREF(item);
1506 1505
1507 1506 if (is_datetimelike) {
1508 1507 PyObject_Free(cLabel);