[2.7] bpo-36421: Fix ref counting bugs in _ctypes.c's PyCArrayType_ne… · python/cpython@0516f81 (original) (raw)

Original file line number Diff line number Diff line change
@@ -1537,6 +1537,7 @@ PyCArrayType_new(PyTypeObject *type, PyObject *args, PyObject *kwds)
1537 1537 if (length * itemsize < 0) {
1538 1538 PyErr_SetString(PyExc_OverflowError,
1539 1539 "array too large");
1540 +Py_DECREF(stgdict);
1540 1541 return NULL;
1541 1542 }
1542 1543
@@ -1559,8 +1560,10 @@ PyCArrayType_new(PyTypeObject *type, PyObject *args, PyObject *kwds)
1559 1560 /* create the new instance (which is a class,
1560 1561 since we are a metatype!) */
1561 1562 result = (PyTypeObject *)PyType_Type.tp_new(type, args, kwds);
1562 -if (result == NULL)
1563 +if (result == NULL) {
1564 +Py_DECREF(stgdict);
1563 1565 return NULL;
1566 + }
1564 1567
1565 1568 /* replace the class dict by our updated spam dict */
1566 1569 if (-1 == PyDict_Update((PyObject *)stgdict, result->tp_dict)) {
@@ -1574,12 +1577,16 @@ PyCArrayType_new(PyTypeObject *type, PyObject *args, PyObject *kwds)
1574 1577 A permanent annoyance: char arrays are also strings!
1575 1578 */
1576 1579 if (itemdict->getfunc == _ctypes_get_fielddesc("c")->getfunc) {
1577 -if (-1 == add_getset(result, CharArray_getsets))
1580 +if (-1 == add_getset(result, CharArray_getsets)) {
1581 +Py_DECREF(result);
1578 1582 return NULL;
1583 + }
1579 1584 #ifdef CTYPES_UNICODE
1580 1585 } else if (itemdict->getfunc == _ctypes_get_fielddesc("u")->getfunc) {
1581 -if (-1 == add_getset(result, WCharArray_getsets))
1586 +if (-1 == add_getset(result, WCharArray_getsets)) {
1587 +Py_DECREF(result);
1582 1588 return NULL;
1589 + }
1583 1590 #endif
1584 1591 }
1585 1592