# HG changeset patch # User Yuya Nishihara # Date 2018-09-05 12:49:44 # Node ID 094d1f42c484bb43b68e073bd49897a31c48b978 # Parent ca77788c81bc449a6ebd47f80d1a50a3813002b4 manifest: fix leak on error return from lazymanifest_filtercopy() Spotted by ASAN. free(copy->lines) and Py_DECREF(copy->pydata) are replaced by Py_XDECREF(copy), which should call lazymanifest_dealloc(). Freeing half-initialized copy->lines is safe since copy->numlines holds a valid value. diff --git a/mercurial/cext/manifest.c b/mercurial/cext/manifest.c --- a/mercurial/cext/manifest.c +++ b/mercurial/cext/manifest.c @@ -731,16 +731,14 @@ static lazymanifest *lazymanifest_filter arglist = Py_BuildValue(PY23("(s)", "(y)"), self->lines[i].start); if (!arglist) { - return NULL; + goto bail; } result = PyObject_CallObject(matchfn, arglist); Py_DECREF(arglist); /* if the callback raised an exception, just let it * through and give up */ if (!result) { - free(copy->lines); - Py_DECREF(copy->pydata); - return NULL; + goto bail; } if (PyObject_IsTrue(result)) { assert(!(self->lines[i].from_malloc)); @@ -752,6 +750,7 @@ static lazymanifest *lazymanifest_filter return copy; nomem: PyErr_NoMemory(); +bail: Py_XDECREF(copy); return NULL; }