diff options
| author | Michael Droettboom <mdboom@gmail.com> | 2011-05-02 10:27:04 -0400 |
|---|---|---|
| committer | Mark Wiebe <mwwiebe@gmail.com> | 2011-05-02 11:43:56 -0700 |
| commit | ded703d47944a95c370eb1ecf518034162a89394 (patch) | |
| tree | 0ebf149486f0b588f64a0e464aaef90af150b534 | |
| parent | 26c957b0d7040e8a74ceb8d597de40f55d521aa8 (diff) | |
| download | numpy-ded703d47944a95c370eb1ecf518034162a89394.tar.gz | |
BUG: Fix a bug where memory was being read after being freed.
On my system (Python 2.7, RHEL5), the call to func.__name__
returns a temporary Python string object with only a single
reference. Dereferencing it before copying out its contents
results in reading freed memory.
| -rw-r--r-- | numpy/core/src/umath/umathmodule.c.src | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/numpy/core/src/umath/umathmodule.c.src b/numpy/core/src/umath/umathmodule.c.src index 7a76c2b3e..8d081f85b 100644 --- a/numpy/core/src/umath/umathmodule.c.src +++ b/numpy/core/src/umath/umathmodule.c.src @@ -94,7 +94,6 @@ ufunc_frompyfunc(PyObject *NPY_UNUSED(dummy), PyObject *args, PyObject *NPY_UNUS fname_len = 1; PyErr_Clear(); } - Py_XDECREF(pyname); /* * self->ptr holds a pointer for enough memory for @@ -119,6 +118,7 @@ ufunc_frompyfunc(PyObject *NPY_UNUSED(dummy), PyObject *args, PyObject *NPY_UNUS self->ptr = _pya_malloc(offset[0] + offset[1] + sizeof(void *) + (fname_len + 14)); if (self->ptr == NULL) { + Py_XDECREF(pyname); return PyErr_NoMemory(); } Py_INCREF(function); @@ -139,6 +139,8 @@ ufunc_frompyfunc(PyObject *NPY_UNUSED(dummy), PyObject *args, PyObject *NPY_UNUS memcpy(str+fname_len, " (vectorized)", 14); self->name = str; + Py_XDECREF(pyname); + /* Do a better job someday */ self->doc = "dynamic ufunc based on a python function"; |