Issue #10914: fix bogus memory management in Modules/getpath.c, leading to a possible crash when calling Py_SetPath()

This commit is contained in:
Antoine Pitrou 2011-03-17 23:34:33 +01:00
parent 9befeb3743
commit bb6eb857cf

View file

@ -134,6 +134,7 @@ static wchar_t prefix[MAXPATHLEN+1];
static wchar_t exec_prefix[MAXPATHLEN+1];
static wchar_t progpath[MAXPATHLEN+1];
static wchar_t *module_search_path = NULL;
static int module_search_path_malloced = 0;
static wchar_t *lib_python = L"lib/python" VERSION;
static void
@ -634,7 +635,6 @@ calculate_path(void)
bufsz += wcslen(zip_path) + 1;
bufsz += wcslen(exec_prefix) + 1;
/* This is the only malloc call in this file */
buf = (wchar_t *)PyMem_Malloc(bufsz*sizeof(wchar_t));
if (buf == NULL) {
@ -687,6 +687,7 @@ calculate_path(void)
/* And publish the results */
module_search_path = buf;
module_search_path_malloced = 1;
}
/* Reduce prefix and exec_prefix to their essence,
@ -726,15 +727,18 @@ void
Py_SetPath(const wchar_t *path)
{
if (module_search_path != NULL) {
free(module_search_path);
if (module_search_path_malloced)
PyMem_Free(module_search_path);
module_search_path = NULL;
module_search_path_malloced = 0;
}
if (path != NULL) {
extern wchar_t *Py_GetProgramName(void);
wchar_t *prog = Py_GetProgramName();
wcsncpy(progpath, prog, MAXPATHLEN);
exec_prefix[0] = prefix[0] = L'\0';
module_search_path = malloc((wcslen(path) + 1) * sizeof(wchar_t));
module_search_path = PyMem_Malloc((wcslen(path) + 1) * sizeof(wchar_t));
module_search_path_malloced = 1;
if (module_search_path != NULL)
wcscpy(module_search_path, path);
}